Oblog多用户博客程序strMonth变量过滤不严导致SQL注入漏洞

文件In/ClassUserCommand.asp : 1. strMonth=Request"month" //第63行 2. 3. strDay=Request"day" 4. 5. …… 6. 7. Case "month" //第84行 8. 9. Dim LastDay 10. 11. GPFileName = GPFileName & "month&month=" & strMonth 12. 13. strDay=LeftstrMonth,4 & "-" & RightstrMonth,2 & "-01" 14. 15. mYear=LeftstrMonth,4 16. 1...