WooYun.org

http://www.jumbotcms.net/ajax/content.aspx?cType=soft&id=22&oper=ajaxDownCount&debugkey=5E7D-8A8B-F75C-BFF3

protected void Page_Load(object sender, EventArgs e)
{
    base.Server.ScriptTimeout = 8;
    this._operType = base.q("oper");
    string CS$4$0000 = this._operType;
    if (CS$4$0000 != null)
    {
        if (!(CS$4$0000 == "ajaxDownCount"))
        {
            if (CS$4$0000 == "ajaxAddFavorite")
            {
                this.ajaxAddFavorite();
                goto Label_0059;
            }
        }
        else
        {
            this.ajaxDownCount(); //跟进
            goto Label_0059;
        }
    }
    this.DefaultResponse();
Label_0059:
    base.Response.Write(this._response);
}

private void ajaxDownCount()
{
    string _type = base.q("cType"); //cType为固定几个值 我们选soft
    if (!base.ModuleIsOK(_type))
    {
        base.Response.Write("请勿恶意攻击");
        base.Response.End();
    }
    if (base.Str2Int(base.q("addit")) == 1)
    {
        base.doh.Reset();
        base.doh.ConditionExpress = "id=" + base.q("id");
        base.doh.Add("jcms_module_" + _type, "DownNum");
    }
    base.doh.Reset();
    base.doh.ConditionExpress = "id=" + base.q("id");//看这里
    this._response = "{\"count\" :\"" + base.Str2Int(base.doh.GetField("jcms_module_" + _type, "DownNum").ToString()) + "\"}"; //跟进GetField 函数
}

public object GetField(string _tableName, string _fieldName, bool _isField)
{
    this.tableName = _tableName;
    this.fieldName = _fieldName;
    if (_isField)
    {
        this.SqlCmd = "select [" + this.fieldName + "] from [" + this.tableName + "]";
    }
    else
    {
        this.SqlCmd = "select " + this.fieldName + " from [" + this.tableName + "]";
    }
    if (this.ConditionExpress != string.Empty)
    {
        this.SqlCmd = this.SqlCmd + " where " + this.ConditionExpress;  //this.ConditionExpress 就是上面的 "id=" + base.q("id"); 接着看下q（）函数吧
    }
    this.cmd.CommandText = this.SqlCmd;
    this.GenParameters();
    object ret = this.cmd.ExecuteScalar();
    if (ret == null)
    {
        ret = string.Empty;
    }
    return ret;
}

public string q(string s)
{
    if ((HttpContext.Current.Request.QueryString[s] != null) && (HttpContext.Current.Request.QueryString[s] != ""))
    {
        return Strings.SafetyQueryS(HttpContext.Current.Request.QueryString[s].ToString());//跟进
    }
    return string.Empty;
}
public static string SafetyQueryS(string theString)
{
    string[] aryReg = new string[] { "'", ";", "\"", "\r", "\n", "<", ">" };
    for (int i = 0; i < aryReg.Length; i++)
    {
        theString = theString.Replace(aryReg[i], string.Empty);
    }
    return theString;
}
//过滤了' < > 所以上面是存在注入的 可以构造