6CMS enterprise website management system (Chinese and English Traditional Chinese Version) SQL injection vulnerability and repair

Author: Monkey QQ: 812009485

I just got home from the holiday. I am idle and have nothing to do, and it's heavy snow. I don't want to go out and soak mm ..

Suddenly I saw an enterprise cms, So I downloaded the program.

G.cn Keyword: 6CMS enterprise Site Management System (Chinese and English Traditional Chinese Version)

Default Account Password: admin

Background: admin/

I don't know how the programmer got it. I can see that the admin directory of the program has an anti-injection SQL. asp

But the parent directory does not

Default Database: data/# sze7xiaohu. mdb

Seeion verification is also a bit messy. Remember that there is a file in the admin directory that can be directly accessed to publish a job (which file is specific). It seems that messages can be directly published.

Put it directly.

Back up the database directly in the background.

I feel that there is no practical value. It's boring. You should study it yourself.

Fixed: filtering and enhanced verification