There is a code execution vulnerability caused by the upload of a plugin in the src/main/java/com/cool/core/plugin/service/CoolPluginService.java

[liyunqiangs]

Dynamic JAR loading lacks security verification.

Construct a JAR package containing malicious code.The IP address of the attack machine is 10.252.120.38,and the server address is 10.25.10.140.

Log in to an account with plugin management function remotely.

Malicious plugin was successfully uploaded and initialized for execution.

The attack machine listened to port 8080 and successfully received the request from the server.