WooYun.org

http://cms.wangqi.com/ajax.aspx

public void Page_Load(object sender, EventArgs e)
{
    switch (base.Request.Form["cmd"])
    {
        ......
         case "artlist":
         this.method_9(); //跟进
         return;

private void method_9()
{
    string str = base.Request.Form["cid"];
    string str2 = base.Request.Form["aid"]; //没处理存在注入
    string str3 = "{\"result\":";
    if (!string.IsNullOrEmpty(str) && (int.Parse(str) > 0))
    {
        bool flag = true;
        str3 = str3 + "1,\"data\":[";
        string cmdText = "select e.ID,eName,vName,eCss from wqcms_expand e left join wqcms_extval v on v.eID=e.ID where nID=" + str2 + " and clsID=" + str + " order by eSort asc";
        IDataReader reader = base.dbHelper.ExecuteReader(CommandType.Text, cmdText, new IDataParameter[0]);
        while (reader.Read())
        {
            if (flag)
            {
                flag = false;
            }
            object obj3 = str3;
            str3 = string.Concat(new object[] { obj3, "{\"id\":\"", reader["ID"], "\",\"name\":\"", this.method_10(base.Server.HtmlDecode(reader["eName"].ToString())), "\",\"val\":\"", ((reader["vName"] == DBNull.Value) | (reader["vName"] == null)) ? "" : this.method_10(base.Server.HtmlDecode(reader["vName"].ToString())), "\",\"css\":\"", this.method_10(base.Server.HtmlDecode(reader["eCss"].ToString())), "\"}," });
        }
        str3 = str3.TrimEnd(new char[] { ',' });
        reader.Close();
        if (flag)
        {
            cmdText = "select ID,eName,eCss from wqcms_expand where clsID=" + str + " order by eSort asc";
            reader = base.dbHelper.ExecuteReader(CommandType.Text, cmdText, new IDataParameter[0]);
            while (reader.Read())
            {
                object obj2 = str3;
                str3 = string.Concat(new object[] { obj2, "{\"id\":\"", reader["ID"], "\",\"name\":\"", this.method_10(base.Server.HtmlDecode(reader["eName"].ToString())), "\",\"val\":\"\",\"css\":\"\"}," });
            }
            str3 = str3.TrimEnd(new char[] { ',' });
            reader.Close();
        }
        str3 = str3 + "]";
    }
    else
    {
        str3 = str3 + "0";
    }
    str3 = str3 + "}";
    this.method_32(str3);
}