SiteServer cms系统modal_UserView.aspx页面 sql注入漏洞

- AV AC AU C I A
发布: 2025-04-13
修订: 2025-04-13

1.漏洞代码。 在Bin\UserCenter.Pages.dll文件中,UserCenter.BackgroundPages.Modal.UserView类的Page_Load方法中,可以见到如下代码: ``` public void Page_Load(object sender, EventArgs e) { string text = base.Request.QueryString["UserName"]; //获取UserName bool flag2; bool flag = (flag2 ? 1u : 0u) > 4294967295u; ArrayList arrayList; if (!flag) { if (3 != 0) { this.xb9335f5bbebb5da2 = UserDataProvider.get_UserDAO().GetUserInfo(text); //传入GetUserInfo函数 if (2 != 0) { } ArrayList relatedIdentities = UserManager.GetRelatedIdentities(this.xb9335f5bbebb5da2.get_TypeID()); ArrayList tableStyleInfoArrayList = TableStyleManager.GetTableStyleInfoArrayList(11, ............................................................................................ } ``` 接着看看UserCenter.Provider.dll\UserCenter.Provider.Data.SqlServer/UserDAO.cs下的GetUserInfo函数 : ``` public UserInfo GetUserInfo(string userName) { UserInfo userInfo = null; UserInfo result; if (15 != 0) { while (!string.IsNullOrEmpty(userName)) { string text =...

0%
暂无可用Exp或PoC
当前有0条受影响产品信息