CNVD-2021-32799: 360 Xintianqing - SQL Injection

漏洞描述

The Tianqing Terminal Security Management System, designed for government and enterprise use, faces a SQL injection vulnerability. This flaw could enable attackers to access sensitive database information.

PoC代码[已公开]

id: CNVD-2021-32799

info:
  name: 360 Xintianqing - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    The Tianqing Terminal Security Management System, designed for government and enterprise use, faces a SQL injection vulnerability. This flaw could enable attackers to access sensitive database information.
  reference:
    - https://blog.51cto.com/u_9691128/4295047
    - https://www.cnvd.org.cn/patchInfo/show/270651
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/CNVD/2021/CNVD-2021-32799.yaml
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="360新天擎"
  tags: cnvd2021,cnvd,360,xintianqing,sqli

http:
  - method: GET
    path:
      - '{{BaseURL}}/api/dp/rptsvcsyncpoint?ccid=1'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"reason":'
          - '"success"'
          - '"antiadwa":'
          - '"clientupgrade":'
        condition: and

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008730010b54ee78db2d222881c4946923edf9ac943463534db0211b2c3261339902206d885381f005b16255c47358fee1b3045dfb2eaabd16166f008e5773f8e006d6:922c64590222798bb761d5b6d8e72950

来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/./http/cnvd/2021/CNVD-2021-32799.yaml