GoCDKEY 游戏推广系统上传漏洞 - 脚本漏洞

以下是引用片段：

....省略一千万行....
set fs=server.CreateObject("scripting.filesystemobject")
set upload=new upload_5xSoft ''建立上传对象
'--------将日期转化成文件名--------
formPath="/uploadfile/"
formpath2=upload.form("type")  //* BUG出现在这里，type值 从from获得 自定义路径
formPath=formPath&formPath2 //*路径生成。。。。uploadfile+type
if upload.form("adsrc")="" then 
adsrc="ADSrc"
else
adsrc=upload.form("adsrc")
end if
''在目录后加(/)
if right(formPath,1)"/" then formPath=formPath&"/"
set file=upload.file("picture") ''生成一个文件对象
if file.FileSize>0 then ''如果 FileSize > 0 说明有文件数据
if file.filesize>300000 then
response.write""
response.end
end if
FileExt        = Mid(file.Filename, InStrRev(file.Filename, ".")+1)
FileExt        = FixName(FileExt)
If Not ( CheckFileExt(FileExt) ) Then
response.write""
response.end
end if

thename=MakedownName()&"."&FileExt
'开始判断会员图片目录是否存在
  Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
    If objFSO.FolderExists(Server.MapPath(""&formPath&"")) Then'如果存在就直接保存图片
  file.SaveAs Server.mappath(formPath&thename)
  Else
  objFSO.CreateFolder(Server.MapPath(""&formPath&""))'不存在就建一个目录
  file.SaveAs Server.mappath(formPath&thename)
 
  Set Jpeg = Server.CreateObject("Persits.Jpeg") '调用组件
Path = Server.MapPath(formPath&thename) '待处理图片路径
Jpeg.Open Path
If Jpeg.OriginalWidth / Jpeg.OriginalHeight > 1 then
Jpeg.Width = 350
Jpeg.Height = int((350/Jpeg.OriginalWidth)*Jpeg.OriginalHeight)
elseif Jpeg.OriginalWidth / Jpeg.OriginalHeight
Jpeg.Height = 350
Jpeg.Width= int(Jpeg.OriginalWidth*(350/Jpeg.Height))
end if

Jpeg.Save Server.MapPath(formPath&thename)

  End If
  Set objFSO = Nothing      '释放 FileSystemObject 对象实例内存空间
imgs=thename
else
response.write""
response.end
end if

%>

以下是引用片段：