Dibo Data Decision-Making System Path Traversal Vulnerability in Download Function

A path traversal vulnerability has been identified in Dibo Data Decision-Making System versions through 2.7.0. The issue arises in the `downloadImpTemplet` function within the file `/common/dep/common_dep.action.jsp`. The vulnerability allows for arbitrary file read by manipulating the `filePath` argument, with no input validation to prevent access to restricted files. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary file read, which could lead to exposure of sensitive information from the server.

Reproduction

To reproduce this vulnerability, send a GET request to `/common/dep/common_dep.action.jsp` with the `action` parameter set to `downloadImpTemplet`. Include a `filePath` value that traverses the directory structure to access a file outside the intended directory, such as `/WEB-INF/web.xml`. The `fileName` parameter can be set to any value, as it is not validated.