| 标题 | Beijing Weili Digital Technology Co., Ltd 微力同步 v2.21.3 Download any file |
|---|
| 描述 | During a security assessment of the "微力同步 v2.21.3" version, I found an arbitrary file download vulnerability in the Web administration module. The core interface of this module does not implement valid identity authentication logic, which leads attackers to directly obtain synchronization files and download synchronization files and system sensitive files in the target device by using the software Web management module.Corrective action must be taken immediately to ensure system safety. |
|---|
| 来源 | ⚠️ https://github.com/jjjjj-zr/jjjjjzr/issues/7 |
|---|
| 用户 | jjjjjzr (UID 92774) |
|---|
| 提交 | 2025-11-21 14時50分 (5 月前) |
|---|
| 管理 | 2025-12-06 18時34分 (15 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 334618 [Verysync 微力同步 2.21.3 Web Administration download?key=dummytoken 信息公开] |
|---|
| 积分 | 20 |
|---|