Tipask uses shell in the background

Recently I saw a vulnerability in the tipask system. It seems that only the root user can get the shell, but the background features are so rich. I tried another shell method, although it is not a killer, it is barely usable.

Isn't the SQL Execution function provided in the tipask background?

Insert a sentence in the database, and then back up the file like XX. ASP; _. SQL through the database backup function, because the backup database file is added at the beginning of each # <? Exit ();?>, Therefore, it can only be used on IIS6 that supports both asp.

At the same time, the file name is verified during database backup, so it is OK to submit the local breakthrough verification.
No technical skills. Please forgive me.