Hzhost6.5 latest SQL vulnerability in the VM management system (vulnerability patch included)

Author: prester Web: http://www.hacksb.cn
------------
In fact, the vulnerabilities are not new at all, and they have been lying down for N days at t00ls, that is, no one has been transferred out ..
If you remember correctly, this is the fourth time that the Chinese people have discovered a vulnerability,
I am very optimistic about their programmers.
This vulnerability exists in the channeldmectr. asp file, which does not filter any parameters.
I have a genuine patch here. Open it and check it. The channeldmectr. asp file with the patch is from lines 21st to lines 40th. Add the following code:

Function SafeRequest (ParaName)
Dim ParaValue
ParaValue = Request (ParaName)
If IsNumeric (ParaValue) then
SafeRequest = ParaValue
Exit Function
Else
ParaValuetemp = lcase (ParaValue)
Tempvalue ="Select | insert | delete | union |
Join | script | applet | object | '| drop | update | truncate |
Create | xp_cmdshell | exec | alter | cast | rename | modify"
Temps = split (tempvalue, "| ")
For mycount = 0 to ubound (temps)
If Instr (ParaValuetemp, temps (mycount)> 0 and lcase (ParaName) <> "module" then
Call errorpage (-2, "the content you submitted contains the character [" & temps (mycount) & "]. Please remove it and submit it again or contact us ...")
Response. end
End if
Next