add: AVE-2023-0115

Author: adysec

vulns/2023/AVE-2023-0115.toml

@@ -0,0 +1,33 @@
+[basic]
+description = "宏景eHR人力资源管理软件存在SQL注入漏洞，未经过身份认证的远程攻击者可利用categories参数构造恶意SQL语句，执行任意SQL指令，从而窃取后端数据库中敏感信息，如用户凭证、人事数据等。"
+published = "2023-06-01"
+remediation = "升级宏景eHR至8.2或更高版本，联系厂商获取安全补丁。同时建议对categories参数实施严格的输入过滤和参数化查询，防止SQL注入攻击。"
+score = 9.8
+severity = "CRITICAL"
+sources = [
+    "nuclei",
+    "cnvd",
+]
+title = "宏景eHR人力资源管理系统SQL注入漏洞"
+updated = "2026-07-14"
+
+[exploit]
+exp_urls = []
+poc_urls = []
+
+[id]
+aliases = [
+    "NUCLEI-HTTP-CNVD-2023-CNVD-2023-08743-YAML",
+    "CNVD-2023-08743",
+]
+ave_id = "AVE-2023-0115"
+
+[meta]
+collected_at = "2026-07-14T21:39:51.265095406+00:00"
+status = "completed"
+
+[references]
+urls = [
+    "https://blog.csdn.net/qq_41904294/article/details/130944159",
+    "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2023/CNVD-2023-08743.yaml",
+]