Description
JimuReport是中国JEECG开源的一个免费报表工具。
JimuReport v1.7.8版本存在安全漏洞，该漏洞源于组件/jeecg-boot/jmreport/dict/list中存在问题，允许攻击者通过精心设计的GET请求提升权限。
JimuReport /jmreport/dict/list 存在权限管理不当漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.nsfocus.net/vulndb/105026
https://www.hnitns.com/index.php?id=281
https://www.wangsu.com/news/content/blog/3742
https://github.com/jeecgboot/jimureport/issues/2904
https://nvd.nist.gov/vuln/detail/CVE-2024-44893
https://www.oscs1024.com/hd/MPS-lij4-9o80
http://www.see-source.com/news/detail/2306.html
https://cn-sec.com/archives/3178214.html