0-day SiteServer CMS system and repair

Author: fallen leaves
Details: You can use the xx. asp style to register a member just as you did before. The attachment images we upload are also stored according to our membership names. Then the tragic 0-day is generated. Use the IIS parsing feature!
Method of exploits:
First enter usercenter/register. aspx to register the user, and then usercenter/login. aspx to log on to the background. Go to the management center, publish information, and select the title image or attachment to upload. Sometimes we directly change the Trojan to an image format to indicate that uploading is forbidden. If the upload is successful, click "select.
If you cannot see the published article, access/usercenter/siteserver/contentAdd. aspx. Do not select the upload editor when uploading files.

It seems a little bad. Of course it seems someone has published it.

 

Source: fallen leaf s Blog focuses on network security!