Siteserver cms 3.4.5 chicken ribs vulnerability and repair

This vulnerability is very similar to the original vulnerability method!
 
Enable iis6 registration when two conditions are met
 
Register an account-> document attachment management-> upload a file. Before creating a new directory, you can create a *. asp Directory that has been filtered out in 3.4.5.
 
Create a directory! Arbitrary name
 
At this time, we uploaded the file and found that the jpg gif format could not be uploaded, but the txt file could be uploaded. The command XX. ASP;. TXT could not be uploaded.
 
Click "xx.cer=.txt" to upload the file.
 
 
Author: coming late

Fixed: Check the usage method.