WooYun.org

public void ProcessRequest(HttpContext context)
    {
        DataManage.DownLoadManage down = new DataManage.DownLoadManage();
        down.FileDown(context);
}

DataManage.DownLoadManage.FileDown
        public void FileDown(HttpContext context)
        {
            string text = context.Request.QueryString["fid"];  //fid是加密的路径
            context.Response.ContentType = "text/plain";
            if (Utility.IsEmptyString(text))
            {
                …………
            }
            else
            {
                text = text.Trim().Replace("%3d", "=").Replace(" ", "+").Replace("%2f", "/");
                string strKey = "???";  //这是加密解密的密钥，屏蔽了
                string path = Utility.Decrypt3DES(text, strKey);  //解密获取到的路径
                string text2 = context.Server.MapPath(path);   //获取我们传入的虚拟路径的物理路径
                if (File.Exists(text2))
                {
                    string extName = text2.Substring(text2.LastIndexOf('.'));
                    Stream stream = File.OpenRead(text2);		//直接读取text2指定的路径了，导致漏洞的产生
                    …………
                    while (num > 0L && context.Response.IsClientConnected)
                    {
                        int num2 = stream.Read(buffer, 0, Convert.ToInt32(51200L));
                        context.Response.OutputStream.Write(buffer, 0, num2);
                        context.Response.Flush();
                        num -= (long)num2;
                    }
………………