https://www.exploit-db.com/exploits/23852
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-088

Expinion.netMemberManagementSystem是一款基于WEB的网站管理系统。Expinion.netMemberManagementSystem对用户提交的ID参数缺少充分过滤，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得数据库敏感信息。Expinion.netMMS系统包含的’resend.asp’和’news_view.asp’脚本对’ID’参数缺少过滤，提交包含恶意SQL命令作为’ID’参数数据，可能更改原有数据库逻辑，获得敏感信息或更改数据库内容。

source: http://www.securityfocus.com/bid/9931/info
 
It has been reported that Member Management System may be prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The problem is reported to exist in the 'ID' parameter contained within the 'resend.asp' and 'news_view.asp' scripts.
 
Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.


http://www.example.com/resend.asp?ID=[SQL query]

来源:BID
名称:9931
链接:http://www.securityfocus.com/bid/9931
来源:SECTRACK
名称:1009508
链接:http://securitytracker.com/id?1009508
来源:SECUNIA
名称:11179
链接:http://secunia.com/advisories/11179
来源:BUGTRAQ
名称:20040322VulnerabilitiesinMemberManagementSystem2.1
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107999697625786&w;=2
来源:XF
名称:mms-id-sql-injection(15551)
链接:http://xforce.iss.net/xforce/xfdb/15551