FME Flow Zip-Slip file write JSP RCE as LocalSystem

Authenticated FMEToken POST /fmedataupload// with Zip-Slip drops JSP under webapps then HTTP trigger. """FME Flow Zip-Slip archive extract arbitrary JSP write LocalSystem RCE.""" from future import annotations import io import re import zipfile from kittysploit import from lib.exploit.handler...