Description
Lanling OA是中国Lanling公司的一个 OA 管理系统。 Lanling OA Landray Office Automation (OA)存在安全漏洞。攻击者利用该漏洞通过组件/sys/ui/extend/varkind/custom.jsp 读取任意文件。
蓝凌OA custom.jsp 任意文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/tzwlhack/Vulnerability/blob/main/%E8%93%9D%E5%87%8COA%20custom.jsp%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://developer.volcengine.com/articles/7381543614968496138
https://zhuanlan.zhihu.com/p/637421624
https://www.cnblogs.com/pandana/p/14779233.html
https://askding.github.io/Kali/Exploit/Landray-OA.html
https://zeroday.hitcon.org/vulnerability/ZD-2022-00469
https://cn-sec.com/archives/364344.html
https://nvd.nist.gov/vuln/detail/CVE-2022-34924