| 标题 | https://www.qiyuesuo.com/ electronic signature platform <=4.34 RCE |
|---|
| 描述 | In this exploit, the attacker used the platform's scheduled task feature to upload custom Java class files and bypassed the Runtime/Process blacklist detection mechanism by concatenating strings and using reflection. Ultimately, the attacker successfully executed system commands on the server side, completing remote command execution (RCE). |
|---|
| 来源 | ⚠️ https://github.com/nn0nkey/nn0nkey/blob/main/QYS/QYS_task.md |
|---|
| 用户 | nn0nkey (UID 74287) |
|---|
| 提交 | 2025-07-30 10時40分 (1 年前) |
|---|
| 管理 | 2025-08-08 22時26分 (9 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 319298 [Qiyuesuo Eelectronic Signature Platform 直到 4.34 Scheduled Task /api/code/upload execute file 权限提升] |
|---|
| 积分 | 0 |
|---|