jishenghua jshERP Path Traversal Vulnerability in SystemConfigController Export Function

A critical path traversal vulnerability has been identified in jshERP versions through 3.5. The issue arises in the 'exportExcelByParam' function within 'SystemConfigController.java', where the 'title' parameter is manipulated, allowing attackers to traverse directories. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary file creation or overwriting of existing files in targeted directories.

Reproduction

To reproduce this vulnerability, send a request to the '/systemConfig/exportExcelByParam' endpoint with a crafted 'title' parameter that includes path traversal sequences. This will exploit the lack of validation on the parameter, leading to unauthorized file access or modification.