用友U8+渠道管理(高级版) /download-new.jsp 文件读取漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://mrxn.net/jswz/yonyou-business-common-toviewspecial-fileread.html
• https://mrxn.net/tag/%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96
• https://github.com/zan8in/wy876-POC
• https://github.com/novysodope/fupo_for_yonyou
• https://mrxn.net/jswz/metasoft-download-new-fileread.html
• https://cn-sec.com/archives/2723777.html
• https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BU8-CRM%E5%AE%A2%E6%88%B7%E5%85%B3%E7%B3%BB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9Fdownloadfile.php%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md

Related Vulnerabilities

• 網韻資訊｜NewSiteServer (NSS) 新式校園網站系統 - Missing Authentication
• 網韻資訊｜NewSiteServer (NSS)新式校園網站系統 - Arbitrary File Upload
• PoCCVE-2026-16268: Newsletters < 4.16 - Unauthenticated SSRF via SNS Bounce Handler
• PoCCVE-2026-41432: New API < v0.12.10 - Stripe Webhook Bypass
• PoC泛微E-cology10 /papi/passport/appnew/login/appLogin 未授权访问漏洞
• 信呼oa v2.7.6 api.php downimgnew 接口任意服务端请求伪造漏洞
• 鸿翼文档管理系统 importNewBpmnDesignByIe 代码执行漏洞
• PoC方正畅享全媒体采编系统 /newsedit/msg/cc.do 信息泄露漏洞
• 云连ERP管理系统 /gateway/download!download.action 代码执行漏洞
• 泛微 e-cology10 /papi/em/transform/downLoadSyslog 文件读取漏洞
• 方向标邮件网关 /common/cgi/download.cgi 代码执行漏洞
• 天地伟业 Easy7 /Easy7/rest/downLoad/downLoadImage 文件读取漏洞
• PoCCVE-2026-3018: WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection