Jnoj Directory Traversal for file reading(LFI)

By
Manindar Mohan
Published on
20 Dec 2021
Vulnerability

Description:

Directory traversal is available in Jiangnan Online Judge (aka jnoj) 0.8.0 for file reading via the web/polygon/problem/viewfile?id=1&name=.../ substring

Recommendation:

We suggest that you update Jnoj to a version > 0.8.0 in order to fix this vulnerability.


Written by
Manindar Mohan
Manindar Mohan
Cyber Security Lead Engineer
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 14 days