CVE-2018-1002202 PoC — zip4j 路径遍历漏洞

Description

CWE-Bench-Java CVE-2018-1002202 versions 1.3.2, 1.3.3

介绍

# zip4j

This repository contains decompiled source code for the zip4j library versions 1.3.2 (vulnerable) and 1.3.3 (fixed) for CVE-2018-1002202, for the CWE-Bench-Java dataset. The original zip4j repository on Github doesn't include code from these versions.

## Versions

  ### Version 1.3.2 (Vulnerable)
  - **Tag**: `1.3.2`
  - **Status**: Contains path traversal vulnerability
  - **Source**: Decompiled from `zip4j-1.3.2-sources.jar` 
  - **Buggy Commit**: `d87ffa2d64ffb3a0a1cf0c7a69c7b19d7015bfde`
  - [1.3.2 sources jar download page](https://repo1.maven.org/maven2/net/lingala/zip4j/zip4j/1.3.2/)

  ### Version 1.3.3 (Fixed)
  - **Tag**: `1.3.3`
  - **Status**: Vulnerability patched
  - **Source**: Decompiled from `zip4j-1.3.3-sources.jar` 
  - **Fixed Commit**: `59aeea594ff885e06c25751dc6334dfea1bed8c6`
  - [1.3.3 sources jar download page](https://repo1.maven.org/maven2/net/lingala/zip4j/1.3.3/)

## Original Project

  - Original Author: Srikanth Lingala
  - [Original Repository](https://github.com/srikanth-lingala/zip4j)

文件快照

备注