KesionCMS V7.0 directly uses shell and fixes

Someone has previously announced the shell process.
I will give you a good demonstration today. I wish you a lot of shell.
Demo Website: www.2cto.com

Directly open admin/login. asp in the background
 



Here, we use the default password to enter the system password for demonstration.
Default password: admin admin888 authentication code 8888
Next, press 123 on my image.
 
 

Generate/1.asp/ directory
Let's add another static tag to add our pony.
 

 


Add a custom page by yourself. If you want to write a template by name or something, select tags.html.

Add the pony, that is, the custom tag, to our template.
And save it.
Then release the new page. After the release, Click Preview.
 

Everyone will do the following. Haha, shell, a lot.
Daniel flew over
 
Supplement: if it is not the default password, try to download its database.
Most of the sites are not changed:
Database address of version 7.0 or later: KS_Data/KesionCMS7.mdb
6.0 database address: KS_Data/KesionCMS6.mdb

Fix: Modify the default password, modify the database address, and prevent downloading