WooYun.org

protected void Page_Load(object sender, EventArgs e)
		{
			...略
					string id = this.Page.Request.QueryString["Id"];/*URL传参*/
					this.LoadMe(id);/*直接将string字符串代入该方法 跟进方法*/
				略...
		}
private void LoadMe(string id)
{
	DataTable announceist = this.GetAnnounceist(id);/*参数未处理直接代入 GetAnnounceist方法*/
	 略...
}
public DataTable GetAnnounceist(string id)
{
	int trueWebID = Globals.get_TrueWebID();
	string str = "A.ID ='" + id + "' ";/*直接SQL拼接导致注入*/
	SqlConnection sqlConnection = new SqlConnection(Globals.get_ConnectStr());
	SqlCommand selectCommand = new SqlCommand("SELECT A.* FROM Announces A WHERE " + str, sqlConnection);
	SqlDataAdapter sqlDataAdapter = new SqlDataAdapter(selectCommand);
	DataSet dataSet = new DataSet("ClassDataSet");
	sqlConnection.Open();
	sqlDataAdapter.Fill(dataSet, "ClassData");
	sqlConnection.Close();
	return dataSet.Tables["ClassData"];
}

[WebMethod]
		public string UseOrUnUseUser(string strUserGuid, string strIsUse)
		{
			WebBFSynBase webBFSynBase = new WebBFSynBase();
			bool blIsUse = !(strIsUse == "启用");
			return webBFSynBase.UseOrUnUseUser(strUserGuid, blIsUse).ToString();/*未过滤直接将参数strUserGuid带入到UseOrUnUseUser*/
		}
// WebBFSynBase
public string UseOrUnUseUser(string strUserGuid, bool blIsUse)
{
	string text = "";
	string cmdText = string.Concat(new object[]
	{
		" update Users set LockUser ='",
		blIsUse,
		"' where Guid ='",
		strUserGuid,/*SQL拼接导致注入*/
		"'"
	});
	 略....
	return result;
}

[WebMethod]
		public string UpdatePassword(string strUserGuid, string strUserPass)
		{
			WebBFSynBase webBFSynBase = new WebBFSynBase();
			return webBFSynBase.UpdatePwd(strUserGuid, strUserPass);/*未过滤直接将参数带入到webBFSynBase.UpdatePwd*/
		}
public string UpdatePwd(string strUserGuid, string strUserPass)
{
	string a = "";
	SqlConnection sqlConnection = new SqlConnection(Globals.get_ConnectStr());
	SqlCommand sqlCommand = new SqlCommand(string.Concat(new string[]
	{
		"Update Users Set Password='",
		strUserPass,/*SQL拼接*/
		"' WHERE Guid='",
		strUserGuid,/*SQL拼接*/
		"'"
	}), sqlConnection);
try
	{
		sqlConnection.Open();
		int num = sqlCommand.ExecuteNonQuery();
	}
	catch (SqlException ex)
	{
		a = ex.Message;/*SQL错误信息*/
	}
	finally
	{
		sqlConnection.Close();
	}
	string result;
	if (a != "")/*将错误信息过滤掉*/
	{
		result = "false";
	}
	else
	{
		result = "true";
	}
	return result;
}