J0hNs0N issues

Results 13 issues of


                                            J0hNs0N

Cross site scripting vulnerability

Unauthorized API: @ GetMapping ("/picturesPreview") does not conduct XSS (Cross Site Scripting) defense on the parameter currentUrl, resulting in a cross site scripting attack vulnerability *cn.keking.web.controller.OnlinePreviewController#picturesPreview* ![image](https://user-images.githubusercontent.com/50647385/205541449-da4a939b-37ca-47c5-9a86-659bc7d1a464.png) *src/main/resources/web/picture.ftl* ![image](https://user-images.githubusercontent.com/50647385/205541466-ba7607e2-b24a-4a7d-a93c-9bc432ebf24c.png) Attack...

任意文件上传漏洞

This is the Chinese report, the English report is in（这是中文的漏洞报告，英文的在）: [Arbitrary file upload vulnerability](https://github.com/anji-plus/report/issues/10) ### 描述 ***@PostMapping /reportDashboard/import/{reportCode}*** 导入大屏的接口中，接受文件上传，未对文件后缀进行限制，未对文件名进行检测过滤消毒的操作，导致任意文件删除漏洞 ### 漏洞详细该接口接收文件上传，交给 ***reportDashboardService.importDashboard()*** 进行处理 *com.anjiplus.template.gaea.business.modules.dashboard.controller.ReportDashboardController#importDashboard* ![image-20221026160808669](https://user-images.githubusercontent.com/50647385/197984558-770906ad-5cd8-4ed6-b428-a4807f91d81b.png) 跟进 ***reportDashboardService.importDashboard()***，在该方法中调用了 ***FileUtil.decompress(file, path);***...

Arbitrary file upload vulnerability

这是英文的漏洞报告，中文的在(This is the English report, the Chinese report is in): [任意文件上传漏洞](https://gitee.com/anji-plus/report/issues/I5XU86) ### Description ***@PostMapping /reportDashboard/import/{reportCode}*** In the interface of importing the big screen, it accepts file uploads, does not limit...