| शीर्षक | http://jimureport.com/ https://mvnrepository.com/artifact/org.jeecgframework.jimureport/jimureport-spring-boot-starter/1.6.1 jimureport <= 1.6.1 arbitrary file write |
|---|
| विवरण | Jimureport has the function of remotely downloading files and writing them to the server, but the file name is not verified during the download and writing process, resulting in a special file name can be constructed to write arbitrary files, and an attacker can exploit this vulnerability to write SSH public key or write WAR packages to deploy Trojan files (when the application is deployed with Tomcat). |
|---|
| स्रोत | ⚠️ https://github.com/N0b1e6/exp/blob/main/README.md |
|---|
| उपयोगकर्ता | N0b1e6 (UID 42939) |
|---|
| सबमिशन | 17/11/2023 04:14 AM (3 साल पहले) |
|---|
| संयम | 26/11/2023 04:08 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 246133 [jeecgboot JimuReport तक 1.6.1 /download/image imageUrl निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 19 |
|---|