WooYun.org

1、
defaultroot/public/editor/tpsc.jsp
2、
defaultroot/public/editor/1_tpsc.jsp
3、
defaultroot/work_flow/formOptJSPUpload.jsp （上传后路径：/defaultroot/work_flow/文件名）
4、
defaultroot/work_flow/formStartJSPUpload.jsp（上传后路径：/defaultroot/work_flow/文件名）
5、
http://oa.polyfilm.net:7001/defaultroot/govezoffice/custom_documentmanager/smartUpload.jsp?path=innerMailbox&fileName=innerMailFileName&saveName=innerMailSaveName&tableName=innerMaildisplaytable&fileMaxSize=0&fileMaxNum=0&fileType=&fileMinHeight=0&fileMinWidth=0&fileMaxHeight=0&fileMaxWidth=0
6、
http://hljxwjtheb.vicp.cc:7001/defaultroot/custom_form/smartUpload.jsp?path=innerMailbox&fileName=innerMailFileName&saveName=innerMailSaveName&tableName=innerMaildisplaytable&fileMaxSize=0&fileMaxNum=0&fileType=&fileMinHeight=0&fileMinWidth=0&fileMaxHeight=0&fileMaxWidth=0

<%
if(request.getParameter("flag") != null){
    myUpload.initialize(pageContext);
    myUpload.upload();
    for(int j=0;j<myUpload.getFiles().getCount();j++){
        com.jspsmart.upload.File myFile = myUpload.getFiles().getFile(j);
        if(!"jsp".equals(myFile.getFileExt())){
            %>
            <script language="javascript">
            alert("<bean:message bundle="workflow" key="workflow.workflowuploadjspfile"/>");
            </script>
            <%
        }else{
            myFile.saveAs("\\work_flow\\" + myFile.getFileName());
            %>
            <script language="javascript">
            opener.document.all.startJSPName.value = '<%=myFile.getFileName()%>';
            window.close();
            </script>
            <%
        }
    }
}
%>

7、
http://hljxwjtheb.vicp.cc:7001//defaultroot/public/jsp/goodsphotoupload.jsp?path=goodspic&visualName=goodsPicName&hiddenName=goodsPicName&del=yes
http://oa.polyfilm.net:7001/defaultroot/public/editor/1_tpsc.jsp
http://www.baidu.com/s?cl=3&wd=Wanhu+ezOFFICE
http://74.125.227.77/#newwindow=1&q=Wanhu+ezOFFICE&start=20