【0day】英雄宽频 WEB 站任意下载漏洞

download.asp：

Dim path
path=Request.QueryString("file")
If path"" Then
On Error Resume Next
path=Server.MapPath(path)
downloadfile(path)
End If
function downloadfile(fullpath)
downloadfile = false
dim strfilename, s, fso, f, intfilelength
set fso = server.createobject("scripting.filesystemobject")
if not fso.fileexists(fullpath) Then
response.write "对不起，该文件不存在"
response.end
exit function
end if
set f = fso.getfile(fullpath)
' 获取文件大小
intfilelength = f.size
set s = server.createobject("adodb.stream")
s.open
s.type = 1
s.loadfromfile(fullpath)
response.buffer = true
response.clear
'response.addheader "content-type","application/x-msdownload"
response.addheader "content-disposition","attachment;filename=" & f.name
response.addheader "content-length" ,intfilelength
response.contenttype = "application/octet-stream"
while not s.eos
response.binarywrite s.read(1024 * 64)
response.flush
wend
s.close
set s = nothing
downloadfile = true
end function
%>