WooYun.org

protected void Page_Load(object sender, EventArgs e)
	{
		string str = "http://" + HttpContext.Current.Request.Url.Authority.ToString() + "/UploadFiles/" + this.ull.GetLogin(true).UserName;
		if (base.Request.QueryString["code"] == null && base.Request.QueryString["FD"] != null)
		{
			if (base.Request.QueryString["ur"] == null && base.Request.QueryString["state"] == null)
			{
				string value = base.Server.UrlDecode(base.Request.QueryString["FD"]);
				this.FileUrl = this.FileJiema(value);
				this.hid.Value = base.Server.UrlDecode(base.Request.QueryString["FD"]);
			}
			else
			{
				if (base.Request.QueryString["state"] == null)
				{
					string value2 = base.Request.QueryString["FD"].ToString().Replace(" ", "+");
					this.FileUrl = this.FileJiema(value2);
					this.hid.Value = value2;
				}
			}
			if (base.Request["state"] != null && base.Request["state"] == "tr")
			{
				string value3 = base.Request.QueryString["FD"];/*第一种注入：带sql的Base64字符串*/
				this.FileUrl = this.FileJiema(value3);/*第一种注入：解码字符串FromBase64String(value));*/
				this.hid.Value = value3;
				this.file = this.bfile.SelectFile(string.Concat(new object[]
				{
					" FileName='",
					this.FileUrl,
					"' and userid=",
					this.ull.GetLogin(true).UserID
				}));/*第一种注入：this.bfile.SelectFile会直接代入sql注入*/
				if (this.file.DownUrl == null)
				{
					base.Response.Write("0");
					base.Response.End();
					return;
				}
				base.Response.Write("http://" + HttpContext.Current.Request.Url.Authority.ToString() + "/Common/File.aspx?code=" + this.file.ExtractionCode);
				base.Response.End();
				return;
			}
			else
			{
				if (base.Request.QueryString["ur"] != null)
				{
					this.file.ExtractionCode = function.GetRandomString(8, 1);
					this.file.DownUrl = str + this.FileUrl;
					this.file.State = 1;
					this.file.UserID = this.ull.GetLogin(true).UserID;
					this.file.FileName = this.FileUrl;
					this.bfile.AddFile(this.file);
					base.Response.Write("http://" + HttpContext.Current.Request.Url.Authority.ToString() + "/Common/File.aspx?code=" + this.file.ExtractionCode);
					base.Response.End();
					return;
				}
			}
		}
		else
		{
			/*第二种注入：比较简单 直接代入code参数*/
			if (base.Request.QueryString["code"] != "" && base.Request.QueryString["code"] != null)
			{
				this.file = this.bfile.SelectFile(" ExtractionCode='" + base.Request.QueryString["code"] + "' ");
				base.Response.Redirect(this.file.DownUrl);/*然后跳转URL   URL中不能包含换行符 所以我这里采用截取的方式以及拼接的方式*/
			}
		}
	}
this.bfile.SelectFile方法代码如下：
public M_File SelectFile(string where)
{
	if (where == "")
	{
		this.sql = "select * from ZL_File";
	}
	else
	{
		this.sql = "select * from ZL_File where " + where;/*直接将条件带入 导入SQL注入 */
	}
	略...
}

private void Application_BeginRequest(object sender, EventArgs e)
		{
			if (base.Request.RequestType.ToUpper() == "GET" && ZoomlaSecurityCenter.GetData())
			{
				function.WriteMessage("产生错误的可能原因：你提交的参数不正确,包含恶意字符串,或检查系统是否开启了SQL防注入功能!", "", "非法SQL注入或存储!");
			}
			if (base.Request.HttpMethod.ToUpper() == "POST" && HttpContext.Current.Request.Files.Count > 0)/*我可以在这里通过post提交方式即可绕过*/
			{
				ZoomlaSecurityCenter.CheckUpladFiles();
			}
		}

<form id="form1"   action="注入地址" method="post">
  
        <input type="submit"  value="逐浪CMS 注入" />
       
    </form>