ShopEx easily distributes Arbitrary File packaging and downloading defects and repair solutions

 

Brief description: You can package and download any file ..

Through registration address: http://shop.fenxiaowang.com/index.php

Go to the trial background

You can use the template packaging function to modify the submission parameters to package files in any path.

The following http://shop-xxxxxxx.shopex.fenxiaowang.com/shopadmin/index.php? Ctl = system/template & act = dlpkg & p [0] = ../../

 

This vulnerability is also prone to shop systems ..

 

If I have nothing to do with it, I receive a text message reminding me that shopex has given me a gift. Should I check it? What is a gift? Where can I collect it ????!!!

 

Proof of vulnerability:

 

Solution: Add path restrictions