Jnoj Directory Traversal for file reading(LFI)

By
Manieendar Mohan
Published on
20 Dec 2021
Vulnerability

Description:

Directory traversal is available in Jiangnan Online Judge (aka jnoj) 0.8.0 for file reading via the web/polygon/problem/viewfile?id=1&name=.../ substring

Recommendation:

We suggest that you update Jnoj to a version > 0.8.0 in order to fix this vulnerability.


Written by
Manieendar Mohan
Manieendar Mohan
Cyber Security Lead Engineer
Experience the Beagle Security platform
Unlock one full penetration test and all Advanced plan features free for 10 days