WoDig社区程序Members.asp页面过滤不严导致SQL注入漏洞

在文件Members.asp中： SearchType=HTMLEncode(Request(&quot;SearchType&quot;)) //第38行 SearchText=HTMLEncode(Request(&quot;SearchText&quot;)) SearchRole=HTMLEncode(Request(&quot;SearchRole&quot;)) CurrentAccountStatus=HTMLEncode(Request(&quot;CurrentAccountStatus&quot;)) JoinedDateComparer=Left(Request(&quot;JoinedDateComparer&quot;),1) LastPostDateComparer=Left(Request(&quot;LastPostDateComparer&quot;),1) JoinedDate_picker=HTMLEncode(Request(&quot;JoinedDate_picker&quot;)) LastPostDate_picker=HTMLEncode(Request(&quot;LastPostDate_picker&quot;)) if SearchType=&quot;all&quot; then SearchType=&quot;UserEmail like '%&quot;&amp;SearchText&amp;&quot;%' or UserName&quot; if SearchText&lt;&gt;&quot;&quot; then item=item&amp;&quot; and (&quot;&amp;SearchType&amp;&quot; like '%&quot;&amp;SearchText&amp;&quot;%')&quot; if JoinedDate_picker&lt;&gt;&quot;&quot; and JoinedDateComparer&lt;&gt;&quot;&quot; then item=item&amp;&quot; and DateDiff(&quot;&amp;SqlChar&amp;&quot;d&quot;&amp;SqlChar&amp;&quot;,'&quot;&amp;JoinedDate_picker&amp;&quot;',UserRegisterTime) &quot;&amp;JoinedDateComparer&amp;&quot; 0&quot; if LastPostDate_picker&lt;&gt;&quot;&quot; and LastPostDateComparer&lt;&gt;&quot;&quot; then item=item&amp;&quot; and DateDiff(&quot;&amp;SqlChar&amp;&quot;d&quot;&amp;SqlChar&amp;&quot;,'&quot;&amp;LastPostDate_picker&amp;&quot;',UserActivityTime) &quot;&amp;LastPostDateComparer&amp;&quot; 0&quot; if SearchRole &lt;&gt; &quot;&quot; then item=item&amp;&quot; and UserRoleID=&quot;&amp;SearchRole&amp;&quot;&quot; if CurrentAccountStatus &lt;&gt; &quot;&quot; then item=item&amp;&quot; and UserAccountStatus=&quot;&amp;CurrentAccountStatus&amp;&quot;&quot; 多个数字变量使用过滤字符的函数过滤导致注入漏洞的产生。 WoDig 4.1.2 厂商补丁 WoDig ------------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： <a href="http://www.wodig.com/" target="_blank" rel=external nofollow>http://www.wodig.com/</a>