References https://github.com/emadshanab/goby-poc/blob/main/Smartbi%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.json http://www.ol4three.com/2021/01/18/WEB/Exploit/Smartbi-%E6%BC%8F%E6%B4%9E%E6%80%BB%E7%BB%93/ https://cn-sec.com/archives/2300630.html https://github.com/ax1sX/SecurityList/blob/main/Java_OA/Smartbi_Audit.md
Related VulnerabilitiesPoCSmartbi /imageimport.jsp 存在任意文件上传thinkadmin-v6-readfile: Thinkadmin v6 readfileSmartbi /vision/share.jsp 权限绕过漏洞Smartbi 远程代码执行漏洞PoCnsfocus-sas-getfile-readfile: 绿盟 SAS堡垒机 GetFile 任意文件读取漏洞PoCsmartbi-address-auth-bypass: Smartbi 权限绕过漏洞PoCsmartbi-bypass-builtin-user-login: Smartbi Default User Weak PasswordPoCsmartbi-changepassword-bypass: Smartbi修改用户密码PoCsmartbi-db2-biconfigservice-rce-temp: Smartbi DB2 RCEPoCsmartbi-db2-biconfigservice-rce: Smartbi DB2 RCEPoCsmartbi-unauthenticated-sqli: SmartBi 全版本 SQl 注入PoCsmartbi-windowunloading-other: Smartbi 远程代码执行漏洞