| शीर्षक | https://www.qiyuesuo.com/ electronic signature platform <=4.34 RCE |
|---|
| विवरण | In this exploit, the attacker used the platform's scheduled task feature to upload custom Java class files and bypassed the Runtime/Process blacklist detection mechanism by concatenating strings and using reflection. Ultimately, the attacker successfully executed system commands on the server side, completing remote command execution (RCE). |
|---|
| स्रोत | ⚠️ https://github.com/nn0nkey/nn0nkey/blob/main/QYS/QYS_task.md |
|---|
| उपयोगकर्ता | nn0nkey (UID 74287) |
|---|
| सबमिशन | 30/07/2025 10:40 AM (1 वर्ष पहले) |
|---|
| संयम | 08/08/2025 10:26 PM (9 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 319298 [Qiyuesuo Eelectronic Signature Platform तक 4.34 Scheduled Task /api/code/upload execute file अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|