簡要描述:
三茗網絡科技有限公司做的全是千博CMS開源的,Admin_文件沒有過濾後台地址而導致漏洞
詳細説明:
網站是千博CMS開源的,因為沒有設置Admin_過濾後台,從而導致後台和編輯器暴漏在網站地圖中。
漏洞證明:
如圖所示
修復方案:
修改後台目錄下Admin_的參數Function Folderpermission(pathName)
PathExclusion=Array(" emp","sanming","_vti_cnf","_vti_pvt","_vti_log","cgi-bin","admin","edu")
Folderpermission =True
for each PathExcluded in PathExclusion
if instr(ucase(pathName),ucase(PathExcluded))>0 then
Folderpermission = False
exit for
end if
next
End Function
將後台目錄填入即可。
之前發佈,忘記寫進BLOG了,現在補上。