I patched two of the ones I found by checking with isnumeric - here's the fix I did with topic.asp
if Request.QueryString("TOPIC_ID") = "" and Request.QueryString("mode") <> "getIP" and Request.Form("Method_Type") <> "login" and Request.Form("Method_Type") <> "logout" then Response.Redirect "default.asp" Response.End else if isNumeric(Request.QueryString("TOPIC_ID")) = true then Topic_ID = Request.QueryString("TOPIC_ID") else response.write("**** off") response.end end if end if
It stopped whatever bot was injecting useless cialis ads that weren't readable since the infection started with /title
My guess is none of the navigation URL links are sanitized.
Just wanted to post a "quick Fix" for folks that aren't programmers.
This is not the correct forum for bugs, and this was identified a long time ago. The following is a bit cleaner than your example.
If (Trim(Request.QueryString("TOPIC_ID")) = "" Or IsNumeric(Request.QueryString("TOPIC_ID")) = False) And Request.Form("Method_Type") <> "login" And Request.Form("Method_Type") <> "logout" Then
Response.Redirect "default.asp"
Response.End
Else
Topic_ID = CLng(Request.QueryString("TOPIC_ID"))
End If
Topic Locked
Posted - 28 February 2016 : 21:41:56
