Online Store ED-SC V2.1 Arbitrary File Upload Vulnerability

This vulnerability has been found on the internet for a long time. No one has mentioned it, so I 'd like to announce it and share it with you. I am not a programmer, so there is no way to explain the code. Please forgive me! Online mall ED-SC V2.1 default backend path www.xxx.com/admins? www.2cto.com/admins/upfile_flash.asp and N many default, but there are these two enough, even can be said to find/upfile_flash.asp path can be. Let's take a look at the process, or many of my friends may not understand it. Since it is an upload vulnerability, it is of course necessary for James to come out. you can directly upload the file using the upload path www.xxx.com/admins/upfile_flash.asp to indicate that the file has been uploaded. The recipient can access the URL www.xxx.com/admins/diy.asp.