| शीर्षक | RuoYi <= 4.8.0 could bypass white list to RCE or Arbitrary code execution |
|---|
| विवरण | As the getBeanName method in the invokeTarget processing flaws, there is a can bypass the whitelist detection of the vulnerability, and the framework of the timed task call relies on the use of the loophole function to obtain the task information, so we can construct a specific statement to be added to the timed task to achieve an arbitrary method to call, which can lead to a hazard of RCE |
|---|
| स्रोत | ⚠️ https://gist.github.com/GSBP0/3c1b0f9dbdd2a48b8f52330cfbbc279b |
|---|
| उपयोगकर्ता | GSBP (UID 79733) |
|---|
| सबमिशन | 15/01/2025 06:29 PM (2 साल पहले) |
|---|
| संयम | 27/01/2025 12:01 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 293512 [y_project RuoYi तक 4.8.0 Whitelist getBeanName अधिकार वृद्धि] |
|---|
| अंक | 19 |
|---|