Maccms asp版本SQL注入

- AV AC AU C I A
发布： 2025-04-13
修订： 2025-04-13

### 简要描述： asp版本安全性有待加强~ ### 详细说明： /user/index.asp ``` sub tg dim userid,Ip,Ly,sql,rsUV,rs userid = be("get","uid") : userid=chkSql(userid,true) on error resume next if isN(application("LyLastDelDate")) then application("LyLastDelDate") = Date() if isNum(userid) and app_popularizestate=1 then Ip = getIP() Ly= getReferer() Set rs = objdb.db("select * from {pre}user where u_id=" & userid &"","rs1") if not rs.eof then sql="Select * From {pre}user_visit where uv_uid = " &userid&" and uv_ip ='"&IP&"' and year(uv_time)="&Year(date)&" and month(uv_time)="&month(date)&" and day(uv_time)="&day(date) set rsUV = objdb.db(sql,"rs1") if rsUV.eof or rsUV.bof then objdb.add "{pre}user_visit",Array("uv_uid","uv_ip","uv_ly","uv_time" ), array(userid,Ip,Ly,now() ) objdb.db "update {pre}user set u_tj=u_tj+1,u_points=u_points+" & app_popularize & " where u_id="& userid,"exe" If DateDiff("d",application("LyLastDelDate"),Date())<>0 Then Sql="delete from {pre}user_visit where year(uv_time)<="&Year(date)&"...

0%

漏洞利用/PoC

暂无可用Exp或PoC

受影响的平台与产品

当前有0条受影响产品信息