WEBSHELL box system V1.0 email box code vulnerability

/Admin/check. asp
 
Check the logon location on the background
 
 
<! -- # Include File = "../conn. asp" -->
<! -- # Include File = "../inc/checkstr. asp" -->
<%
If Trim (Request. Cookies ("YB_Cookies") = "" Then
Response. Redirect "login. asp"
Response. End ()
Else
 
Dim Rs, SQL
SQL = "SELECT * FROM [YB_Admin] where [Admin_Username] = '" & checkstr (Request. cookies ("YB_Cookies") ("Admin_Username") & "'and [Admin_Password] ='" & checkstr (Request. cookies ("YB_Cookies") ("Admin_Password "))&"'"
 
Set Rs = YB_Conn.Execute (SQL)
If Rs. eof then
Response. Redirect "login. asp"
End if
 
End if
%>
 
The cookie submission is not filtered. You can directly use the cookie Submission Tool to submit an account whose password is 'or '1' =' 1. You can bypass the background login and directly enter the management interface.