Description
AJ-Report是anji-plus开源的一个完全开源，拖拽编辑的可视化设计工具。 AJ-Report 1.4.1及之前版本存在权限绕过漏洞，可导致/dataSource/pageList路径下的数据库敏感信息泄露，包括数据库连接地址，用户名，密码等
AJ-Report swagger权限绕过致敏感信息泄露漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/AJ-Report-%E8%AE%A4%E8%AF%81%E7%BB%95%E8%BF%87%E4%B8%8E%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CNVD-2024-15077.md
https://cloud.tencent.com/developer/article/2419692
https://www.cnblogs.com/Rainy-Day/p/18220776
https://vulncheck.com/advisories/aj-report-swagger
https://blog.csdn.net/weixin_57443487/article/details/141281559
https://xz.aliyun.com/t/14460
https://avd.aliyun.com/detail?id=AVD-2024-7314