Zhibang international series 0-day vulnerability removal and repair

Zhibang international series 0-day vulnerability removal and repair
Brief description: this vulnerability is intended for all types of files. No restrictions are imposed on the file format during attachment uploading in the background, so that any types of files can be uploaded.
Method of exploits: there are two places available, one is to upload attachments in the background. The other is to directly access http: // domain name/email/upload_flash.asp or the address submitted by the tool with the upload function http: // domain name/email/upfile_flash.asp;
The files uploaded in the background are under the upload directory, and the files generated in the second part are under the email directory.

Fix: fix the source code to restrict related directory permissions.

Related Processing: Contact zhibang International