乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-19: 细节已通知厂商并且等待厂商处理中 2015-01-19: 厂商已经确认,细节仅向厂商公开 2015-01-29: 细节向核心白帽子及相关领域专家公开 2015-02-08: 细节向普通白帽子公开 2015-02-18: 细节向实习白帽子公开 2015-03-05: 细节向公众公开
mei you wubi le
http://shu.easou.com/宜搜书城http://shu.easou.com/resin-doc/examples/security-basic/viewfile?file=WEB-INF/web.xml
WEB-INF/web.xml<web-app> <display-name>login-xml</display-name> <welcome-file-list> <welcome-file>index.jsp</welcome-file> <welcome-file>index.html</welcome-file> </welcome-file-list> <!-- this is the jsp that a 'login' link uses --> <security-constraint> <web-resource-collection> <web-resource-name>Home</web-resource-name> <url-pattern>/home.jsp</url-pattern> </web-resource-collection> <auth-constraint> <!-- '*' for a <role-name> means "authenticated user with any role" The user must be logged in with some kind of role to access the home page. --> <role-name>*</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Professors</web-resource-name> <url-pattern>/professors/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>professor</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Students</web-resource-name> <url-pattern>/students/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>student</role-name> <role-name>professor</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Staff</web-resource-name> <url-pattern>/staff/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>staff</role-name> <role-name>professor</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>form</auth-method> <form-login-config> <form-login-page>/login.jsp</form-login-page> <form-error-page>/login.jsp?login_error=1</form-error-page> </form-login-config> </login-config> <!-- Resin-specific XmlAuthenticator configuration --> <authenticator> <type>com.caucho.server.security.XmlAuthenticator</type> <init> <!-- Optionally put user information here. --> <user>pince:Txpd1jQc/xwhISIqodEjfw==:staff,website</user> <user>filch:KmZIq2RKXAHV4BaoNHfupQ==:staff</user> <!-- You can also use an external file --> <path>WEB-INF/password.xml</path> </init> </authenticator> <security-role> <role-name>professor</role-name> </security-role> <security-role> <role-name>student</role-name> </security-role> <security-role> <role-name>staff</role-name> </security-role> <security-role> <description>member of the slytherin house</description> <role-name>slytherin</role-name> </security-role> <security-role> <description>member of the gryffindor house</description> <role-name>gryffindor</role-name> </security-role> <security-role> <description>member of the ravenclaw house</description> <role-name>ravenclaw</role-name> </security-role> <security-role> <description>member of the hufflepuff house</description> <role-name>hufflepuff</role-name> </security-role> <security-role> <description>website administrator</description> <role-name>website</role-name> </security-role></web-app>
http://shu.easou.com/resin-doc/examples/security-basic/viewfile?file=WEB-INF/password.xml
WEB-INF/password.xml<!-- password.xml --><authenticator> <!-- professors --> <user name='snape' password='I7HdZr7CTM6hZLlSd2o+CA==' roles='professor,slytherin'/> <user name='mcgonagall' password='4slsTREVeTo0sv5hGkZWag==' roles='professor,gryffindor'/> <!-- students --> <user name='harry' password='uTOZTGaB6pooMDvqvl2Lbg==' roles='student,gryffindor'/> <user name='dmalfoy' password='yI2uN1l97Rv5E6mdRnDFwQ==' roles='student,slytherin'/> <!-- alumni --> <user name='lmalfoy' password='sj/yhtU1h4LZPw7/Uy9IVA==' roles='alumni,gryffindor'/></authenticator>
危害等级:中
漏洞Rank:10
确认时间:2015-01-19 14:45
谢谢,我们会及时改正
暂无