CVE-2024-11238 PoC — Landray EKP 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11238.yaml

Associated Vulnerability

Title:Landray EKP 路径遍历漏洞 (CVE-2024-11238)
Description:Landray EKP是中国蓝凌（Landray）公司的一套办公自动化解决方案，可使公司轻松建模和管理。 Landray EKP V16.0及之前版本存在路径遍历漏洞，该漏洞源于文件/sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile的参数directoryPath会导致路径遍历。

Description

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sys_ui_component/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

File Snapshot


 id: CVE-2024-11238

info:
  name: Landray EKP - Path Traversal
  author: theamanrawat
  severity: me

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!