̳(DVBBS)Show.asp¿վ©

[̳(DVBBS)Show.asp¿վ© ȫ] 
̳(DVBBS)Show.aspҳ˲ϵ¿վ© 


ʱ:2009-05-25 

ϵͳ:WAVDB-01432 

Ӱ汾:DVBBS 8.0.0-8.2.0 

: 
 ̳ΪҪƷ֮һ2001Ͷƹ㲢Ӫõ˹ûĹ㷺֧֡ΪڵһĻ̳Ʒƣռ ˹̳г70ϵû̳һЩӰءεվռߴ80ϣй̳ʵϵı׼ 

©: 
ļshow.aspУ 

filetype=Request("filetype") //75 
username=Request("username") 
 
TempStr = Replace(TempStr,"{$username}",UserName) //244 

filetypeusername˵xss©Ĳ 

©: 

http://www.sitedir.com.cn/show.asp?filetype=xxx&username=nnn<;iframe%20src=http://www.baidu.com></iframe> 
