Description
HJSoft HCM Human Resources Management System 是一款人力资源管理系统，提供全面的人力资源管理功能。系统的 downlawbase 接口存在 SQL 注入漏洞，未正确过滤用户输入中的特殊字符，导致恶意输入被解析为 SQL 命令。攻击者可以利用此漏洞访问、修改或删除数据库中的敏感数据，严重威胁系统的安全性。
HJSoft HCM Human Resources Management System /selfservice/lawresource/downlawbase SQL 注入漏洞（CVE-2025-10197）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-10197
https://cve.imfht.com/detail/CVE-2025-10197
https://www.knowsafe.com/ti/info/0/1000593
https://github.com/eeeeeekkkkkkkk/POC/blob/main/%E5%AE%8F%E6%99%AFHCM%20%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9Fdownlawbase%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://avd.aquasec.com/nvd/2025/cve-2025-10197/
https://vuldb.com/?id.323236
https://radar.offseq.com/threat/cve-2025-10197-sql-injection-in-hjsoft-hcm-human-r-febe3b31
https://cert.kenet.or.ke/cve-2025-10197-hjsoft-hcm-human-resources-management-system-downlawbase-sql-injection
https://access.redhat.com/security/cve/cve-2025-10197