Vulnerability fix in CMS v4.0 or earlier versions

Recently, I have seen many blog friends asking me to send more articles about such vulnerabilities. I am sending an article today. I found this front-end program at my webmaster's house, so I'll take a look at the security of this program, and there are also a lot of people downloading this program, the number of downloads in the webmaster's home is as high as "the website management system CMS (71216 downloads) "I am in the admin_conn.asp file. The file code is a few simple words. Let's look at the source code.

<%
Mdb = "../"
%>

It is simple enough, but it may be due to the negligence of the programmer. This is a database link file, but this file has no fault-tolerant statements, as a result, the following is my local address asp "> hosts.

And this system does not have database anti-download measures, the database can be easily downloaded

This vulnerability can be easily fixed by adding an error-proof statement.

"On error resume next !!!!

This vulnerability should be caused by the programmer's negligence. There is also an admin_conn.asp file in the root directory, which adds an error-proof statement to the programmer,

This vulnerability is very harmful. Please do not use this program to do bad things !!!

This program should have other neglected vulnerabilities, but I haven't been able to read the source code for the past few days. I will watch it later,

Please join us !!!!!!!

I went to the official website to check whether the latest version of the program is 3. 9 This version does not fix this vulnerability. Therefore, this vulnerability can be used to kill all versions.

Also, for writing articles, I changed the database extension of this program to MDB. The program was originally an asp extension, but this vulnerability still exists, some Webmasters have no security awareness, but after changing the extension to mdb for convenience, the database extension is not restored after the database is changed, so this vulnerability can be fully exploited, sin !!!!!