Dynamic Network (DVBBS) Version 8.2.0 background shell method and Prevention

OSS 8.2.0 does not allow you to upload files with extensions such as asp, asa, cer, and htr. Even if you add files of this type to the background, they cannot be uploaded successfully! However, files with the. php suffix can be uploaded! Go to the background and find "Forum layout management" under "common shortcuts ".
Find a forum, go to "Advanced Settings", find "Upload file type", and add the previous PHP file type.

Click "Submit" to save the settings. Post to the front-end and upload the php Trojan with the. PHP suffix. If the current directory on the server supports PHP scripts, you can get Webshell.

Prevention: if you do not need to use php, you can directly remove the php parsing function or disable php-related suffixes from being uploaded.