Four-Faith Water Conservancy Informatization Platform vulnerabilities

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Manipulation of the fileName argument in the file /aloneReport/index.do/../../aloneReport/download.do;othersusrlogout.do results in path traversal. The attack can be initiated remotely and the exploit is now public.

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Manipulation of the fileName argument in the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do leads to path traversal. The attack may be performed remotely and the exploit has been disclosed publicly.

A vulnerability in Four-Faith Water Conservancy Informatization Platform 1.0 affects an unknown function in /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Manipulation of the fileName argument leads to path traversal. The attack can be launched remotely and the exploit is public.

A vulnerability was detected in Four-Faith Water Conservancy Informatization Platform 1.0. Affected by this issue is some unknown functionality of the file /history/historyDownload.do;otheruserLogin.do;getfile. The manipulation of the argument fileName results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.