<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[Z_rr2004的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/Z_rr2004</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; Z_rr2004]]></copyright><item><title><![CDATA[Struts2的几个漏洞复现]]></title><link>https://blog.youkuaiyun.com/Z_rr2004/article/details/140259408</link><guid>https://blog.youkuaiyun.com/Z_rr2004/article/details/140259408</guid><author>Z_rr2004</author><pubDate>Mon, 08 Jul 2024 10:08:36 +0800</pubDate><description><![CDATA[将Content-Type: application/x-www-form-urlencoded改为Content-Type: application/xml。可通过注入OGNL语言进行命令执行。启用Struts  REST插件并使用XStream组件对XML进行反序列操作时，未对数据进行有效验证，可进行远程代码执行攻击。(2) docker-compose up -d 启动。]]></description><category></category></item></channel></rss>