maxcms 电影CMS 注入

漏洞文件/inc/ajax.asp 33-40 行

Sub getscore(ac)   dim id,ary,ret : id=getForm("id","get")   if isNul(id) then die "err"   if ac="newsscore" then    ary=conn.db("SELECT m_digg,m_tread,m_score FROM {pre}news WHERE m_id="&id,"array")   else    ary=conn.db("SELECT m_digg,m_tread,m_score FROM {pre}data WHERE m_id="&id,"array")   end if

这里看下 isNul 函数是做什么判断，inc/CommonFun.asp 191-193

Function isNul(str)   if isnull(str) or str="" then isNul=true else isNul=false  End Function

这里只是简单的判断是不是空，不是空就可以了