目前已知问题strusts低版本能弹计算器,高版本不能,经测试struts-2.2.3.1-all.zip(http://archive.apache.org/dist/struts/binaries/struts-2.2.3.1-all.zip)可弹计算器
0x00 漏洞描述
It is possible to perform a RCE attack when namespace value isn’t set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard name...