The API_Response.asp page of fengxun website management system has the excessive privilege vulnerability.

From ghost son s Blog

Affected Versions:
FooSun> 5.0

Vulnerability Analysis:
In the file API API_Response.asp:

If Request. QueryString <> "" Then // row 16th
SaveUserCookie ()
Else
Set XmlDoc = Server. CreateObject ("msxml2.FreeThreadedDOMDocument" & MsxmlVersion)
XmlDoc. ASYNC = False
If Not XmlDoc. LOAD (Request) Then
Status = 1
Messenge = "the data is invalid. The operation is aborted! "
Appid = "unknown"
Else
If Not (XmlDoc.doc umentElement. selectSingleNode ("userip") is nothing) Then
UserTrueIP = XmlDoc.doc umentElement. selectSingleNode ("userip"). text
End If
If CheckPost () Then
Select Case Act
Case "checkname"

The integration file does not determine whether the program is enabled. Malicious users can submit data to the file to modify and delete users.

Solution:
Vendor patch:
FooSun
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
Http://www.foosun.net/