漏洞描述
泛微ecology存在服务端请求伪造漏洞，该漏洞是由于getFileViewUrl接口对用户发送的请求验证不当导致的。
泛微 ecology getFileViewUrl 服务端请求伪造漏洞
PoC代码
暂无相关漏洞推荐
- ecology-ebridge-addtaste-sqli: 泛微云桥 taste/addTaste SQL注入
- ecology-ifnewscheckoutbycurrentuser-dwr-sqli: 泛微 E-Cology ifnewscheckoutbycurrentuser.dwr SQL 注入
- ecology-ktreeuploadaction-upload: 泛微 e-cology 任意文件上传
- POC ecology-e-office-mysql-config-leak: 泛微OA E-Office mysql_config.ini 数据库信息泄漏
- POC ecology-arbitrary-file-upload: 泛微OA e-cology V9前台任意上传漏洞
- POC ecology-e-office-getselectlist-crm-sqli: 泛微e-office系统存在SQL注入漏洞
- POC ecology-filedownloadforoutdoc-sqli: 泛微 OA filedownloadforoutdoc - SQL injection
- POC ecology-mobile-plugin-checkserver-sqli: 泛微 Ecology OA SQL 注入漏洞
- POC ecology-ofslogin-aul: 泛微 e-cology 任意用户登录漏洞
- POC ecology-v9-sqli: Ecology 9 - SQL Injection
- POC weaver-ecology9-filedownloadlocation-sqli: Weaver E-cology 9.x FileDownloadLocation SQL Injection
- POC ecology-oa-file-sqli: E-cology FileDownloadForOutDocSQL - SQL Injection
- POC ecology-jqueryfiletree-traversal: Weaver E-Cology JqueryFileTree - Directory Traversal