PJBlog博客系统后台Action.asp页面DelUserID变量过滤不严导致SQL注入缺陷

文件control/ Action.aspp中： 1. ElseIf Request.Form"whatdo" = "DelUser" Then //第510行 2. Dim DelUserID, DelUserName, blogmemberNum, DelUserStatus 3. DelUserID = Request.Form"DelID" 4. blogmemberNum = conn.Execute"select countmemID from blogMember where memStatus='SupAdmin'"0 5. 6. DelUserStatus =...