WooYun.org

公司：北京中科恒业科技有限公司
官网：http://www.zoneking.cn/
用户：http://www.zoneking.cn/Zkuser/zkuser.html
google关键字：技术支持：北京中科恒业科技有限公司 inurl:/happy/|/health/|/ardour/|/active/
部分案例：
http://medical.cyszxyy.com:8080/happy/index.asp
http://www.syyyy.cn:82/happy/index.asp
http://www.kqtjzx.com/happy/index.asp
http://tjzx.bydsfy.com/happy/index.asp
http://itha.nmciq.gov.cn/happy/index.asp
http://tjzx.hzch.gd.cn/happy/index.asp
http://www.sptdch.cn:8080/happy/index.asp
http://chati.shiliyiyuan.cn/tjinfo/tjsearch.asp
http://xqxtj.com/health/index.asp
http://qzhtjktj.com/ardour/index.asp
http://www.jyyyw.com:9000/happy/index.asp
http://sh.88888719.com/health/index.asp
http://www.dazhebei.cn/ardour/index.asp
http://www.pmzfy.com/ardour/index.asp
http://www.yqtjzx.com/happy/index.asp
http://www.xnsdyyy.com/happy/index.asp
http://www.zswsxxw.com/happy/index.asp
http://www.xy2fytjzx.com/happy/index.asp
http://www.xy2fytjzx.com/happy/index.asp
http://jkcx.xidian.edu.cn/happy/index.asp
......

<%
                    sql="select id,Sclass from zk_Sclass where bid="&request("bid")&" and id="&request("sid")&" order by px desc" 
					Set Rs=server.CreateObject("Adodb.recordset")
                    Rs.open sql,conn,1,1
	
                    if rs.eof then
					%>

<%
				sqlinfo="select Infotitle,Content from zk_Info where Infoid="&request("id")&" and bid="&request("bid")&" and sid="&request("sid")&"" 
					Set Rsinfo=server.CreateObject("Adodb.recordset")
                    Rsinfo.open sqlinfo,conn,1,1
					if not rsinfo.eof then
					Infotitle=rsinfo("Infotitle")
					Content=rsinfo("Content")
					end if
					rsinfo.close
				%>

<%
if Request("search")="" then
Set Rs = Server.CreateObject("ADODB.Recordset")
Sql = "Select * From zk_gb Order BY [stop] desc, id DESC "
Rs.Open Sql,conn,1,1
else
snr=Request("snr")
stype=Request("stype")
   if snr="" then
   response.write "<script language='javascript'>"
   response.write "alert('你没有输入任何搜索内容！');"
   response.write "history.go(-1);"
   response.write "</script>"
   response.end
   end if
  if stype<>"" then
  Set Rs = Server.CreateObject("ADODB.Recordset")
  Sql = "Select * From zk_gb where "&stype&" like '%" &snr& "%' Order BY [stop] desc, id DESC "
  Rs.Open Sql,conn,1,1
  else
  Set Rs = Server.CreateObject("ADODB.Recordset")
  Sql = "Select * From zk_gb where sname like '%" &snr& "%' or scontent like '%" &snr& "%' or stitle like '%" &snr& "%' Order BY [stop]desc, id DESC "
  Rs.Open Sql,conn,1,1
  end if
end if

<%
'个人用户------------------------------------------------------------------开始
If trim(request("action"))="user" Then
'个人用户登录+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++开始
  If Trim(request("utype"))="login" Then
   
    seltype=Trim(request("seltype"))
    userid=trim(request("userid"))
    username=trim(request("username"))
	pwd=trim(request("password"))
'seltype  选择登录类型  0 体检号 1 身份证 2 VIP号 3 工号	
    select case seltype
	case "0","1","2","3"
	  loginchkformeorr()
	  loginact() 	
	case else
	  'response.Write "登录类没有选择"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	  loginchkformeorr(9999)	  
	end select	
	
  End If
 
'个人用户登录+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++结束
End If
'个人用户------------------------------------------------------------------结束
%>

<%
'选择登录方式
sub loginact()
    select case seltype
	case "0"
	'response.Write "登录类体检号"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~	
    logstudyid()	  
	case "1"
	  'response.Write "登录类身份证"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    logstudysfzh()
	case "2"
	  'response.Write "登录类VIP号"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    logstudyvip()	  
	case "3"
	  'response.Write "登录类工号"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    logstudygh()
	case else
	  'response.Write "登录类没有选择"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	  response.Redirect "reportsearch.asp"
	end select
end sub
%>

<%
'通过体检号登录
sub logstudyid()
	'response.Write ultype	  
	  	  
        Set Rsu=Server.CreateObject("adodb.recordset")
        str_sqlu="Select top 1 * from zk_WebYH where StudyId='"&userid&"' order by userid desc"
        Rsu.open str_sqlu,conn,1,3

<%
cardid=trim(request("cardid"))
tid=trim(request("tid"))
if cardid="" and tid="" then
response.Write "<a href=index.asp'>没有相关的信息，出错了，请返回</a>"
response.End()
%>
......
if not rs1.eof then
'检查是否有在此科室在做过项目
   Set Rs11=server.CreateObject("adodb.recordset")
   sql11="SELECT * FROM "&trim(rs("ksbm"))&"b where studyid='"&trim(request("tid"))&"'"
   rs11.open sql11,conn,1,1
//这里已经有一处SQL注入了，trim(request("tid"))，继续
......
'用户的基本情况
Set Rsac=server.CreateObject("adodb.recordset")
  sqlac="select id,xm,xb,csny,hf,jdrq,dwdm,DJXM,JCXM,YCXM,WCXM from jcxx where SFZH = '"&cardid&"' and id='"&tid&"'"
Rsac.open sqlac,conn,1,1
//这里存在两处SQL注入
//等等，此文件还有很多关于cardid和tid的注入

<%
CID=trim(request("cardid"))
newpass=trim(request("newpass"))
renewpass=trim(request("renewpass"))
......
Set Rs=server.CreateObject("adodb.recordset")
sql="select * from zk_webyh where userid = "&CID&""
'response.Write sql
Rs.open sql,conn,2,3
historyPwd=Rs("PSW")
Rs("PSW")=newpass
rs.update()

<%
msg="文件成功上传！"
msgx="文件成功上传，请不要更改文件的地址！"
set upload=new upload_file
if upload.form("act")="uploadfile" then
	filepath=trim(upload.form("filepath"))
	
	i=0
	for each formName in upload.File
		set file=upload.File(formName)
 
 fileExt=lcase(file.FileExt)	'得到的文件扩展名不含有.
if fileext<>"gif" and fileext<>"jpg" and fileext<>"swf" and fileext<>"png"  then
 response.write "<script language=javascript>alert('上传的文件只支持.JPG,.GIF,.SWF,.PNG格式！');history.go(-1);</script>"
response.End()
end if
filesname=trim(upload.form("filesname"))
filename=filepath&filesname&"."&fileExt
fromfilename=filesname&"."&fileExt
 'response.write filename
%>