万博企业网站管理系统注入漏洞(MemberLogin.asp)

<%@LANGUAGE=\”VBSCRIPT\” CODEPAGE=\”65001\”%> <% Option Explicit %> <%Response.Charset=\”utf-8\”%> <!–#include file=\”../Include/Const.asp\”–> <!–#include file=\”../Include/ConnSiteData.asp\”–> <!–#include file=\”../Include/Md5.asp\”–> <% if request.QueryString(\”Action\”)=\”Out\” then session.contents.remove \”MemName\” session.contents.remove \”GroupID\” session.contents.remove \”GroupLevel\” session.contents.remove \”MemLogin\” response.redirect Cstr(request.ServerVariables(\”HTTP_REFERER\”)) response.end end if Public ErrMsg(3) ErrMsg(0)=\”·登录名不正确，请返回。\” ErrMsg(1)=\”·登录密码不正确，请返回。\” ErrMsg(2)=\”·帐号非使用状态，请返回。\” dim LoginName,LoginPassword,VerifyCode,MemName,Password,GroupID,GroupName,Working,rs,sql LoginName=trim(request.form(\”LoginName\”)) LoginPassword=Md5(request.form(\”LoginPassword\”)) set rs = server.createobject(\”adodb.recordset\”) sql=\”select * from NwebCn_Members where MemName=\’\”&LoginName&\”\’\” rs.open sql,conn,1,3 if rs.bof and rs.eof then WriteMsg(ErrMsg(0)) response.end else MemName=rs(\”MemName\”) Password=rs(\”Password\”) GroupID=rs(\”GroupID\”) GroupName=rs(\”GroupName\”) Working=rs(\”Working\”) end if if LoginPassword<>Password then WriteMsg(ErrMsg(1)) response.end end if if not Working then WriteMsg(ErrMsg(2)) response.end end if if UCase(LoginName)=UCase(MemName) and LoginPassword=Password then rs(\”LastLoginTime\”)=now() rs(\”LastLoginIP\”)=Request.ServerVariables(\”Remote_Addr\”) rs(\”LoginTimes\”)=rs(\”LoginTimes\”)+1 rs.update rs.close set rs=nothing session(\”MemName\”)=MemName session(\”GroupID\”)=GroupID \’=========== set rs = server.createobject(\”adodb.recordset\”) sql=\”select * from NwebCn_MemGroup where GroupID=\’\”&GroupID&\”\’\” rs.open sql,conn,1,1 session(\”GroupLevel\”)=rs(\”GroupLevel\”) rs.close set rs=nothing \’=========== session(\”MemLogin\”)=\”Succeed\” session.timeout=60 response.redirect Cstr(request.ServerVariables(\”HTTP_REFERER\”)) response.end end if %>