Description
AJ-Report（积木报表）是一款开源的可视化报表工具。AJ-Report /dataSet/testTransform 接口存在JavaScript代码注入漏洞，攻击者可通过该接口在服务器端执行任意JavaScript代码，可能导致服务器被控制等严重后果。
AJ-Report积木报表 /dataSet/testTransform;swagger-ui 代码执行漏洞 （CVE-2024-7314）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-7314
https://www.cve.org/CVERecord?id=CVE-2024-7314
https://vulncheck.com/advisories/aj-report-swagger
https://www.sentinelone.com/vulnerability-database/cve-2024-7314/
https://github.com/runZeroInc/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7314.yaml
https://access.redhat.com/security/cve/cve-2024-7314
https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2024-0659.html/