Ewebeditor background passthrough Vulnerability

Lost.cq.cn

I checked the php version of ewebeditor today. I remember that I used to read the php version. The version was relatively low and I didn't even connect to the backend.
Today, I made a 3.8 shopping spree and found something exciting...
In the php version, the backend is to call ../ewebeditor/admin/config. php. You can see the source code.
Method of exploits: first of all, you must find the login background. The default value is ../eWebEditor/admin/login. php. Enter a user and password after entering the background. Of course, an error will be prompted.
In this case, clear the url of the browser and enter javascript: alert (document. cookie = "adminuser =" + escape ("admin"); javascript: alert (document. cookie = "adminpass =" + escape ("admin"); javascript: alert (document. cookie = "admindj =" + escape ("1"); press enter three times to clear the url of the browser. Please note that you should note the entered url this time, the files we need to input this time are all files that can be browsed normally after verification, such .. /ewebeditor/admin/default. php
Haha, just go in. Just like asp, you can add a new style and modify the upload.
Test the asp 2.8 version. It seems that the asp version can be used in the same way. It seems that the asp version can be used only to test the 2.8 version. It seems that the 2.8 version is the highest version)
The aspx version ../ewebeditor/admin/upload. aspx adds the Shell file of the local cer, and enters javascript: lbtnUpload. click () in the receiver to get the shell.
Jsp upload vulnerability and the one that has been running for N long. Because there is no upload button, select the shell to be uploaded and press Enter.
Haha, in the future, if the background of the ewebeditor can be found, you can kill it.