标题：asp eWebEditor v3.8 列目录漏洞(其他版本为测试)
漏洞文件：asp/browse.asp
漏洞产生：

Sub InitParam()
        sType = UCase(Trim(Request.QueryString("type")))
        sStyleName = Trim(Request.QueryString("style"))
        sCusDir = Trim(Request.QueryString("cusdir"))
        Dim i, aStyleConfig, bValidStyle
        bValidStyle = False
        For i = 1 To Ubound(aStyle)
                aStyleConfig = Split(aStyle(i), "|||")
                If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then
                        bValidStyle = True
                        Exit For
                End If
        Next
        If bValidStyle = False Then
                OutScript("alert('Invalid Style.')")
        End If
        sBaseUrl = aStyleConfig(19)
        nAllowBrowse = CLng(aStyleConfig(43))
        nCusDirFlag = Clng(aStyleConfig(61))
        If nAllowBrowse <> 1 Then
                OutScript("alert('Do not allow browse!')")
        End If
        If nCusDirFlag <> 1 Then
                sCusDir = ""
        Else
                sCusDir = Replace(sCusDir, "", "/")
                If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then
                        sCusDir = ""
                Else
                        If Right(sCusDir, 1) <> "/" Then
                                sCusDir = sCusDir & "/"
                        End If
                End If
        End If
        sUploadDir = aStyleConfig(3)
        If Left(sUploadDir, 1) <> "/" Then
                sUploadDir = "../" & sUploadDir
        End If
        Select Case sBaseUrl
        Case "0"
                sContentPath = aStyleConfig(23)
        Case "1"
                sContentPath = RelativePath2RootPath(sUploadDir)
        Case "2"
                sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir))
        End Select
    sUploadDir = sUploadDir & sCusDir
        sContentPath = sContentPath & sCusDir
        Select Case sType
        Case "FILE"
                sAllowExt = ""
        Case "MEDIA"
                sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov"
        Case "FLASH"
                sAllowExt = "swf"
        Case Else
                sAllowExt = "bmp|jpg|jpeg|png|gif"
        End Select
        sCurrDir = sUploadDir
        sDir = Trim(Request("dir"))
'1.假设dir= ../
'2.假设dir=...//
'3.假设dir=.....///
        sDir = Replace(sDir, "", "/")  '过滤1
        sDir = Replace(sDir, "../", "") '过滤2
'1.到这里就被过滤了
        sDir = Replace(sDir, "./", "") '过滤3
'2到这里也被功率了
'3到这里就成../了。比较有趣的饶过！好象不少cms这样过滤过。[/color]
        If sDir <> "" Then
                If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then
                        sCurrDir = sUploadDir & sDir & "/"
                Else
                        sDir = ""
                End If
        End If
End Sub

漏洞发生者：鬼哥