Description
JimuReport是中国JEECG开源的一个免费报表工具。 JimuReport v1.7.8版本存在安全漏洞，该漏洞源于组件/jeecg-boot/jmreport/dict/list中存在问题，允许攻击者通过精心设计的GET请求提升权限。
JimuReport /jeecg-boot/jmreport/dict/list 权限绕过漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/jeecgboot/JimuReport/issues/2904
https://y4tacker.github.io/2024/08/01/year/2024/8/%E6%B5%85%E6%9E%90JeecgBoot-jmreport%E6%9C%80%E6%96%B0%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87/
https://www.hnitns.com/index.php?id=281
https://cn-sec.com/archives/3178214.html
https://www.wangsu.com/news/content/blog/3742