千博cms地图导致后台和编辑器暴漏
来源:范文网 2.81W
简要描述:
三茗网络科技有限公司做的全是千博CMS开源的,Admin_文件没有过滤后台地址而导致漏洞
详细说明:
网站是千博CMS开源的,因为没有设置Admin_过滤后台,从而导致后台和编辑器暴漏在网站地图中。
漏洞证明:
如图所示
修复方案:
修改后台目录下Admin_的参数Function Folderpermission(pathName)
PathExclusion=Array(" emp","sanming","_vti_cnf","_vti_pvt","_vti_log","cgi-bin","admin","edu")
Folderpermission =True
for each PathExcluded in PathExclusion
if instr(ucase(pathName),ucase(PathExcluded))>0 then
Folderpermission = False
exit for
end if
next
End Function
将后台目录填入即可。
之前发布,忘记写进BLOG了,现在补上。