WooYun.org

http://cms.wangqi.com/ajax.aspx

public void Page_Load(object sender, EventArgs e)
{
    switch (base.Request.Form["cmd"])
    {
        case "newsVars":
            this.method_18();
            return;
        case "userJson":
            this.method_19();
            return;
        case "digg":
            this.method_20();
            return;
        case "login":
            this.method_21(false);
            return;
        case "loginAdm":
            this.method_21(true);
            return;
        case "titleDuplicate":
            this.method_16();
            return;
        case "selSort":
            this.method_22();
            return;
        case "msgRecent":
            this.method_25();
            return;
        case "msgFriends":
            this.method_26();
            return;
        case "msgGet":
            this.method_27();
            return;
        case "msgPost":
            this.method_28();
            return;
        case "friendAdd":
            this.method_23();
            return;
        case "friendRemove":
            this.method_24();
            return;
        case "usernameValid":
            this.method_17();
            return;
        case "serverSet":
            this.method_15();
            return;
        case "delimg":
            this.method_14(); //跟进
            return;
.......

private void method_14()
{
    if ((!string.IsNullOrEmpty(base.Request.Form["img"]) && (base.Request.Form["img"].ToLower().IndexOf("/upload/") > -1)) && File.Exists(base.Server.MapPath(base.Request.Form["img"])))
    {
        File.Delete(base.Server.MapPath(base.Request.Form["img"])); //没处理..可跳出这个目录对任意文件进行删除了
    }
    if (!string.IsNullOrEmpty(base.Request.Form["imgID"]) && (Convert.ToInt32(base.Request.Form["imgID"]) > 0))
    {
        base.dbHelper.ExecuteNonQuery(CommandType.Text, "delete from wqcms_imgList where imgID=" + Convert.ToInt32(base.Request.Form["imgID"]), new IDataParameter[0]);
    }
}