Blog任意文件下载漏洞

attachment.asp代码

Path = Trim(Request("path")) '获取用户提交的路径
FileID = Trim(Request("FileID"))
If FileID ="" And Path = "" Then
Response.Write "参数不足"
Response.End
End If
...
If CheckDownLoad Or 1= 1Then
If Path = "" Then
set rs = Server.CreateObject("ADODB.RecordSet")
link_database
SQL = ("select file_path,userid,file_ext,ViewNum FROM oblog_upfile WHERE FileID = "&CLng(FileID))