Description
大华智慧园区综合管理平台是大华技术提供的一种智能化解决方案，旨在提供全面的园区管理和安全监控功能。大华智慧园区综合管理平台的 attachment_downloadByUrlAtt.action 存在文件读取漏洞。
大华DSS综合管理平台 /portal/attachment_downloadByUrlAtt.action 路径存在任意文件下载漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnblogs.com/pursue-security/p/17738749.html
https://peiqi.wgpsec.org/wiki/iot/%E5%A4%A7%E5%8D%8E/%E5%A4%A7%E5%8D%8E%20%E5%9F%8E%E5%B8%82%E5%AE%89%E9%98%B2%E7%9B%91%E6%8E%A7%E7%B3%BB%E7%BB%9F%E5%B9%B3%E5%8F%B0%E7%AE%A1%E7%90%86%20attachment_downloadByUrlAtt.action%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html
https://nebula.wiki/%E6%BC%8F%E6%B4%9E%E5%BA%93/AC/%E5%A4%A7%E5%8D%8E
https://wiki.tntsec.com/docs/bug/iot/%E5%A4%A7%E5%8D%8E/%E5%A4%A7%E5%8D%8E%E5%9F%8E%E5%B8%82%E5%AE%89%E9%98%B2%E7%9B%91%E6%8E%A7%E7%B3%BB%E7%BB%9F%E5%B9%B3%E5%8F%B0%E7%AE%A1%E7%90%86%E5%AD%98%E5%9C%A8attachment_downloadByUrlAtt.action%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.html
https://www.cnvd.org.cn/flaw/show/CNVD-2020-61986
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/iot/%E5%A4%A7%E5%8D%8E-%E5%9F%8E%E5%B8%82%E5%AE%89%E9%98%B2%E7%9B%91%E6%8E%A7%E7%B3%BB%E7%BB%9F%E5%B9%B3%E5%8F%B0%E7%AE%A1%E7%90%86-attachment_downloadByUrlAtt.action-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E.md
https://www.fxbaogao.com/detail/4680397
https://download.xray.cool/vul/453vul.pdf