Description
本漏洞出现在在线文档解析应用中的远程页面下载功能。具体问题在于该应用未能对用户输入的URL进行充分的安全验证，从而导致在13.10.1之前的版本中存在安全隐患。攻击者可通过构造特殊的URL，引诱应用下载恶意文件。
iDocView /html/2word 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/d7bb33fc-d7e0-4a26-855b-fccffb054cc3
https://github.com/adysec/POC/blob/main/wpoc/iDocView/I%20Doc%20View%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://www.wangsu.com/news/content/blog/3618
https://cloud.tencent.com/developer/article/2376094
https://blog.csdn.net/WangsuSecurity/article/details/135114954
https://rivers.chaitin.cn/vuldb/d7bb33fc-d7e0-4a26-855b-fccffb054cc3
https://cn-sec.com/archives/2302149.html
https://www.secrss.com/articles/60990
https://juejin.cn/post/7317854227748290560
https://www.ddpoc.com/DVB-2024-5853.html
https://zhuanlan.zhihu.com/p/668379259
http://www.bmth666.cn/2023/12/15/I-Doc-View%E5%9C%A8%E7%BA%BF%E6%96%87%E6%A1%A3%E9%A2%84%E8%A7%88-%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/index.html
https://dev.to/sharon_42e16b8da44dabde6d/idocview-rce-vulnerability-how-a-simple-url-leads-to-remote-code-execution-1ccc