1、The authentication logic of the system's background /admin is in code AdminLoginInterceptor：
2、This can easily be bypassed, like request //admin:
1)We delete the requested cookie field and then request /admin,returns 302：
2）But if we request //admin，We can perform administrator actions without logging in，
For example, upload a babat file：
It can execute any server command，such as calc：
1、The authentication logic of the system's background /admin is in code AdminLoginInterceptor：
2、This can easily be bypassed, like request //admin:
1)We delete the requested cookie field and then request /admin,returns 302：
2）But if we request //admin，We can perform administrator actions without logging in，
For example, upload a babat file：
It can execute any server command，such as calc：
