Yu Dama's article Management System YM1.0 0day

Alimail

Yu Dama's article Management System YM1.0 does not strictly filter user messages, and the database does not perform any processing. you can insert a sentence and quickly win Shell.

I didn't want to read this set of programs. When I was about to delete it, I found a keyword Google and found that the system had a large number of users. After a simple test, I could win it.

Google: inurl: lunshow. asp? Pid inurl:/js/lunshow. asp? Pid later found in the test that the first keyword is mostly entertaining, and the second one contains some c9 users.

Open the webpage and jump directly to/guest/index. on the asp page, the message content is a classic one-sentence, and the total number of rows is reduced. The database address is/db/% 23% 20db. asa, connect.