Currently, asp Website background backup Bypass

Author: Blueboy
He fooled me before he got it done ......
After that, you will know what is going on .....................
Sub backupdata ()
Dbpath = request. form ("Dbpath ")
Dbpath = server. mappath (Dbpath)
Bkfolder = request. form ("bkfolder ")
Bkdbname = request. form ("bkdbname ")
Set Fso = server. createobject ("scripting. filesystemobject ")
If fso. fileexists (dbpath) then
If CheckDir (bkfolder) = True Then
Fso. copyfile dbpath, bkfolder & "& bkdbname
Else
MakeNewsDir bkfolder
Fso. copyfile dbpath, bkfolder & "& bkdbname &". asa"
End if
Response. write "<center> the database is successfully backed up. The backed up database is" & bkfolder & "& bkdbname &". asa </center>"
Else
Response. write "the file you want to back up cannot be found. "
End if
End sub
Looking at the red mark above, whether you are creating a directory backup or a backup in the old directory, you will be given a sentence:
Response. write "<center> the database is successfully backed up. The backed up database is" & bkfolder & "& bkdbname &". asa </center>"
Xxxxx file name. asa backed up successfully, but I do not know whether it is actually:
Fso. copyfile dbpath, bkfolder & "& bkdbname
Xxxx file name backed up successfully.
So you only need to access xxx and your file name will be OK, for example: previusfiles/1. asp, ignore the following.
Some websites will write as follows:
Response. write "<center> the database is successfully backed up. The backed up database is" & bkfolder & "& bkdbname &". mdb </center>"
As a result, we all thought that the parsing vulnerability of ISS has written a file name similar to the following ----- x. asp: 1, which is actually incorrect and directly written.
1. Access asp directly --- bakup/1. asp is OK!
It's boring...