乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2012-10-22: 细节已通知厂商并且等待厂商处理中 2012-10-24: 厂商已经确认,细节仅向厂商公开 2012-11-03: 细节向核心白帽子及相关领域专家公开 2012-11-13: 细节向普通白帽子公开 2012-11-23: 细节向实习白帽子公开 2012-12-06: 细节向公众公开
RT!
首先看一个以前典型的case: WooYun: 去哪儿任意文件读取(基本可重构该系统原工程) 或哥这篇粗糙的文章:http://hi.baidu.com/shine%5F%C9%C1%C1%E9/blog/item/7d7d57445f523a4384352468.html
http://caipiao.xunlei.com/WEB-INF/web.xml
<beans xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd" default-lazy-init="true"><description>Spring公共配置文件</description><!-- 对配置信息的统一管理 ,可以动态刷新属性值begin--><bean class="com.aicaipiao.webclient.obixlabs.xconfig.adapters.spring.XConfigProcessor"><constructor-arg value="classpath:/xconfiguration.xml"/></bean><!-- <bean id="propertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"> <property name="locations"> <list> <value>classpath:application.properties</value> </list> </property> </bean> --><!-- 对配置信息的统一管理 ,可以动态刷新属性值end--><!-- import webclient common context begin --><import resource="classpath*:webclient-common-context.xml"/><!-- import webclient common context end --><!-- hessian调用平台服务里的接口 begin--><import resource="classpath*:remoting-core-service-client.xml"/><!-- hessian调用平台服务里的接口 end--><!-- memcached client配置 begin --><!-- memcached连接参数配置 begin --><import resource="classpath*:cacheContext.xml"/><bean id="memClientConfig" class="com.aicaipiao.memcached.client.spy.MemClientConfig"><constructor-arg index="0" type="java.lang.String" value="${memClientConfig_url}"/></bean><bean id="memcachedIdGenerator" class="com.aicaipiao.memcached.client.spy.MemcachedIdGenerator"><property name="systemId" value="webclient"/><property name="moduleId" value="all"/></bean><!-- memcached client配置 end --></beans>
附带svn:http://backend.t.kankan.com/.svn/entrieshttp://backend.t.kankan.com/.svn/text-base/common.php.svn-basehttp://t.kankan.com/.svn/entries
多注意WEB-INF目录!
危害等级:低
漏洞Rank:1
确认时间:2012-10-24 03:47
感谢反馈,我们马上处理!
暂无