（1）
Log in as a normal user, post, and you cannot upload a jsp file when posting a topic



jsp file is not allowed to upload
（2）
After logging in to the management page as an administrator user, modify the configuration information to allow uploading files with jsp extension

Select basic configuration

Select Submit and use tool to intercept packets

Modify parameters to add jsp suffix

（3）
Log in as a normal user, add theme, add attachments, select jsp files with malicious command execution functions to upload

Execute system command “whoami”