<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[ccccccrr的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/ccccccrr</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; ccccccrr]]></copyright><item><title><![CDATA[Bigtree V 4.2.18文件上传漏洞漏洞复现（CVE-2017-9442）]]></title><link>https://blog.youkuaiyun.com/ccccccrr/article/details/149923709</link><guid>https://blog.youkuaiyun.com/ccccccrr/article/details/149923709</guid><author>ccccccrr</author><pubDate>Tue, 05 Aug 2025 08:54:55 +0800</pubDate><description><![CDATA[Bigtreev4.2.18在上传zip格式的扩展包时，其解压后的扩展包通常被放置于SERV_ROOT/cache/package/目录中，其上传的扩展需要先unpack，可是解压缩后的包不会被立刻删除，而是安装后才会删除，因此可是上传带有webshell功能的php脚本，造成文件上传漏洞。]]></description><category></category></item></channel></rss>