Quick message book v10.09 official Version Vulnerability Analysis

Author: Unknown
Affected Version: quick message book v10.09
Vulnerability description:

Upload Vulnerability:
Vulnerability page:/up/add. asp
Method of exploits: Add a vulnerability page address directly behind the message book:

Cookie spoofing vulnerability:
Vulnerability page:/up/admin_main.asp,/up/admin_list.asp
Cookie verification is used in the code. As a result, you can enter the management background and set the upload type.
Finally, the Webshell is uploaded. The vulnerability code is as follows:
<% If request. cookies ("picc") ("picc2") <> "" then %>
<P align = "center"> </P>
<P align = "center">
<%
Dim Msg
If Request. QueryString ("Action") = "Save" Then SaveData
Sub SaveData ()
MyConn.exe cute ("update Config set OKAr =" & Request. Form ("ftype") & ", OKsize =" & Request. Form ("fsize "))
Msg = "the file data information has been modified successfully"
End Sub
If msg <> "Then
Response. write ("<meta http-equiv = refresh content = 2; URL = admin_main.asp> "& Msg &" <br> <a href = admin_main.asp> click here to return </a> ")
Response. End ()
End If
%> </P>
How to use it. Let's think about it by yourself. I think it should be difficult.