Weak passwords and upload vulnerabilities (including fixes) at the background of a site in Suning)

1. The site is:
Http://campus.suning.com/snjyw/
2. Background address
Http://campus.suning.com/snjyw/login.jsp
 
 
3. log on to www.2cto.com
 
 
4. check account management and find that more than 20 accounts are administrators, all of which are weak passwords.
 
 
1. the backend Upload File Management can directly upload jsp webshells
 
 
2. Attach a kitchen knife and manage files as follows:
 
 
3. The database account is root, and the password is also weak. Please pay attention to these details.
 
 
4. The application is also run by root,
 






 
Solution:

Attitude determines everything