xinhu-oa
xinhu oa Information leakage xinhu V2.1.9 After the user logged in, open the following page poc: /index.php?a=gettotal&m=index&d=home&atype=&loadci=&optdt=&nums=gong,kqdk,apply,officic,syslog,about&ajaxbool=true
Display the information in the picture
Check the source code and find that nums is not restricted,/webmain/home/index/indexAction.php
Change ajaxbool = false to ajaxbool = true