dvbbs asp版 0day

作者：落叶粪飞

来源 马骏's blog

漏洞文件是Query.asp，漏洞代码：

Copy code................................................................................................
stable=Replace(Request("stable"),"'","")
...................................................................................................
If stable="" Or Len(stable)>10 Then stable=Dvbbs.NowUseBbs
.....................................................................................................
If Len(stable)>8 Then Dvbbs.AddErrCode(35)
........................................................................................................
Case 2
If Not Dvbbs.master Then SearchUserID =SearchUserID&" And signflag<2"
SqlColumn = SqlColumn & " From " & stable & " Where "&searchboard&" ParentID>0 And PostUserID="&SearchUserID&" Order By AnnounceID Desc"
Dvbbs.Stats = Dvbbs.Stats & template.Strings(8)
........................................................................................................