WooYun.org

技术支持：新禾科技
版权所有:河北新禾科技(集团)有限公司 电话:0311-85265566
百度dork： inurl:cyportal （案例可参照之前的漏洞）

String filePath = RequestUtil.convertParameter(request.getParameter("filePath"), "iso-8859-1", "gbk");
    String templateName = RequestUtil.convertParameter(request.getParameter("templateName"), "iso-8859-1", "gbk");
    OutputStream out = response.getOutputStream();
    File f = new File(filePath + templateName);
    response.setContentType("appliaction/xml");
    String fileName = templateName;
    byte[] b1 = fileName.getBytes("GBK");
    fileName = new String(b1, "8859_1");
    response.setHeader("Content-Disposition", "attachment;filename=" + fileName);
    InputStream in = new FileInputStream(f);
    BufferedInputStream bfIn = new BufferedInputStream(in);
    Long l = new Long(f.length());
    byte[] b = new byte[l.intValue()];
    int c;
    while ((c = bfIn.read(b)) != -1)
    {
      int c;
      out.write(b, 0, c);
    }
    out.flush();
    bfIn.close();
    in.close();
    out.close();

String operate = request.getParameter("operate");
    GenerateUtils util = new GenerateUtils();
    String rootPath = util.getProjectRootPath();
    String filePath = rootPath + "TempFile/";
    if (operate.equals("all")) {
      result = outputAllTemplateConvertXML(templateOutputService, filePath, siteID);
    }