ZK Framework 漏洞列表

ZK Framework 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 is susceptible to information disclosure. An attacker can access sensitive information via a crafted POST request to the component AuUploader and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations.

ZK Framework 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 is susceptible to information disclosure. An attacker can access sensitive information via a crafted POST request to the component AuUploader and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations.

ZK Framework是一款开源的Ajax+mobile java WEB架构，集成jQuery, Spring, JPA, Hibernate,JavaEE, Grails, Scala等。ZK Framework存在文件读取漏洞，攻击者可利用该漏洞获取服务器敏感信息。