Bitrac personal blog system background Privilege Escalation Vulnerability

Bug. Center. Team

Bitrac personal blog system background Privilege Escalation Vulnerability

Affected Versions:
Bitrac internal Beta

Program introduction:
The Bitrac internal beta version is released. Bitrac is based on ASP. NET 2.0 + SQLite single-user blog program, built-in URLRewrite and page compression functions, support for MetaWeblogAPI, self-written HTML template engine, easy to modify style, complete visual editing environment. This version is currently in beta testing.

Vulnerability Analysis:

In Control. ashx,

Case "Auttab ":
New AdmAuttab (). OutWrite ();
Return;
Go to function
Switch (SiteFun. ParseInt (base. Request. QueryString ["exe"])
{
Case 1: // Add
{
.....
AuthorItem oAuthor = new AuthorItem ();
OAuthor. UserName = SiteFun. ParseStr (base. Request. Form ["auName"]);
OAuthor. PassWord = SiteFun. ParseStr (base. Request. Form ["auPass"]);
OAuthor. UserMail = SiteFun. ParseStr (base. Request. Form ["auMail"]);
If ((! String. IsNullOrEmpty (oAuthor. UserName )&&! String. IsNullOrEmpty (oAuthor. PassWord ))&&! String. IsNullOrEmpty (oAuthor. UserMail ))
{
If (data. ExistUsername (oAuthor. UserName ))
{
Base. Response. Write ("0 user name already exists ");
Return;
}
If (data. ExistUsermail (oAuthor. UserMail ))
{
Base. Response. Write ("0 email address already exists ");
Return;
}
OAuthor. PassWord = SiteFun. SHAEncode (oAuthor. PassWord );
OAuthor. Publish = DateTime. Now;
OAuthor. Address = SiteLoad. Author. Address;
OAuthor. Grade = SiteFun. ParseBte (base. Request. Form ["auKind"]);
If (oAuthor. Grade> 2)
{
OAuthor. Grade = 0;
}
OAuthor. ID = data. InsertAuthor (oAuthor );
Base. response. write (string. format ("1 <tbody id =" autV _ {3} "> <tr id =" autS _ {3} "> <td> <a href =" javascript: $. run (12, 2, 0, {3 }); ">{0 }</a> </td> <td >{1} </td> <td >{7} </td> <td >{2} </td> <td >{8} </td> </tr> <tr id = "autE _ {3}" class = "hide"> <td colspan = "5 "> <p> <label> Name: </label> <input type = "text" cdata = "{0}" id = "autE _ {3} _ Name" name = "autE _ {3} _ Name" value = "{0}" size = "20"/> </p> <label> permission: </label> <select id = "autE _ {3} _ Kind" name = "autE _ {3} _ Kind" >{9} </select> </p> <p> <label> password: </label> <input type = "password" id = "autE _ {3} _ Pass" name = "autE _ {3} _ Pass" value = "" size =" 20 "/> </p> <label> Email: </label> <input type = "text" cdata = "{7}" id = "autE _ {3} _ Mail" name = "autE _ {3} _ Mail" value = "{7}" size = "20"/> </p> <div> <a class = "sav" href = "javascript: $. run (12,2, 1, {3}); "> Save </a> <a class =" can "href =" javascript: $. run (12,2, 3, {3}); "> cancel </a> <a class =" del "href =" javascript: $. run (12, 2, 2, {3 }); "> Delete </a> <span id =" autE _ {3} _ Info "class =" info "> </span> </div> </td> </ tr> </tbody> ", new object [] {oAuthor. userName, this. listAuGrade [oAuthor. grade], oAuthor. publish. toString (SiteLoad. scheme. formatsDT), oAuthor. ID, SiteDat. getLan ("Edit"), SiteDat. getLan ("Delete"), SiteDat. getLan ("ConfirmDelAuthor"), oAuthor. userMail, 0, this. buildSelect (oAuthor. grade )}));
Return;
}
Base. Response. Write ("0 required fields must be filled in ");
Return;
 
............
}
Case 2: // modify
{
AuthorItem item2 = new AuthorItem ();
Item2.ID = SiteFun. ParseInt (base. Request. Form ["auID"]);
If (item2.ID! = 0)
{
If (data. SelectAuthorGrade (item2.ID)> = base. Author. Grade) & (item2.ID! = Base. Author. ID ))
{
Base. Response. Write ("0 you have no permission to modify this user ");
Return;
}
Item2.UserName = SiteFun. ParseStr (base. Request. Form ["auName"]);
Item2.PassWord = SiteFun. ParseStr (base. Request. Form ["auPass"]);
Item2.UserMail = SiteFun. ParseStr (base. Request. Form ["auMail"]);
If (string. IsNullOrEmpty (item2.UserName) | string. IsN