Dynamic Network dvbbs7.1 Forum privilege Elevation Vulnerability and prevention (figure) _ Vulnerability Research

In June on the black defense to see "dynamic network 7.1 loopholes found in the world," a paper, said admin_postings.asp file

There is an injection vulnerability, but the prerequisite is to have the super owner or front desk administrator privileges. I think of the previous discovery of the 7.x version of the network has a foreground privilege elevation loophole, just can be combined to use. This foreground privilege elevation vulnerability is valid for both access and SQL versions of 7.x. Let's use the 7.0 SP2 SQL version to explain the exploit.

Vulnerability Analysis
We know that the dynamic network is through the GroupID to determine the current user's group, and then through the group's information to judge the user's permissions. How did it get this groupid? Let's take a look at the Login verification section:

About 525 lines of login.asp.

Rem ========== Forum Login function =========

Rem Judge User Login

Function Chkuserlogin (Username,password,mobile,usercookies,ctype)



............ The preceding code omits

Sql= "Select Userid,username,userpassword,useremail,userpost,usertopic,usersex,userface

, Userwidth,userheight,joindate,lastlogin,userlogins,lockuser,userclass,usergroupid,usergroup,

Userwealth,userep,usercp,userpower,userbirthday,userlastip,userdel,userisbest,userhidden,

Usermsg,ischallenge,usermobile,titlepic,usertitle,truepassword,usertoday "

Sql=sql+ "from [Dv_user] Where" &sqlstr& ""

Set Rsuser=dvbbs.execute (SQL)

If rsuser.eof and Rsuser.bof Then

Chkuserlogin=false

Exit Function

Else

Imyuserinfo=rsuser.getstring (, 1, "| | |", "", "")

RsUser.Close:Set Rsuser = Nothing

End If

Imyuserinfo = "dvbbs| | |" & Now & "| | |" & Now & "| | |" & Dvbbs.boardid & "| | |" &

Imyuserinfo & | | | Dvbbs "

Imyuserinfo = Split (imyuserinfo, "| | |")

If Trim (password) <>trim (Imyuserinfo (6)) Then

Chkuserlogin=false

ElseIf imyuserinfo (=1) Then

Chkuserlogin=false

ElseIf imyuserinfo (=5) Then

Chkuserlogin=false

Else

Chkuserlogin=true

Session (Dvbbs.cachename & "UserID") = Imyuserinfo

Dvbbs.userid = Imyuserinfo (4)

Regname = Imyuserinfo (5)

Article = Imyuserinfo (8)

Userlastlogin = Imyuserinfo (15)

UserClass = Imyuserinfo (18)

GroupID = Imyuserinfo (19)

Titlepic = Imyuserinfo (34)

If article<0 Then article=0

End If

............ The following code omits

You can see that the dynamic network will be the user's information first with "| | |" Three vertical bars are connected, as a string passed to Imyuserinfo, and then imyuserinfo by "| | |" Separated into an array of strings. When the user password is validated correctly, the value of the 20th element of the array: Imyuserinfo (19) is assigned to the GroupID. See, GroupID is just the value of the 20th element of the array, and if the value of Imyuserinfo (19) is 1, the net will assume that the user who is now logged in is the front desk administrator.

In the dv_clsmain.asp file in the INC directory there is also a section of code that authenticates the user to detect the user's permissions after the user updates the information.

About 650 lines of dv_clsmain.asp.

Public Sub Truecheckuserlogin ()

...... The preceding omission

Dim Rs,sql

Sql= "Select Userid,username,userpassword,useremail,userpost,usertopic,usersex,

Userface,userwidth,userheight,joindate,lastlogin,userlogins,lockuser,userclass,usergroupid,

Usergroup,userwealth,userep,usercp,userpower,userbirthday,userlastip,userdel,userisbest,

Userhidden,usermsg,ischallenge,usermobile,titlepic,usertitle,truepassword,usertoday "

Sql=sql+ "from [Dv_user] Where UserID =" & UserID

Set Rs = Execute (SQL)

If rs.eof and Rs.bof Then

Rs.Close:Set Rs = Nothing

UserID = 0

Emptycookies

Letguestsession ()

Else

Myuserinfo=rs.getstring (, 1, "| | |", "", "")

Rs.Close:Set Rs = Nothing

If IsArray (Session (CacheName & "UserID") Then

Myuserinfo = "dvbbs| | |" & Now & "| | |" & Session (CacheName & "UserID") (
2) & "| | |" & Boardid & "| | |" & Myuserinfo & "| | | Dvbbs "

Else

Myuserinfo = "dvbbs| | |" & Now & "| | |" & DATEADD ("S", -3600,now ()) & "| | |"
& Boardid & "| | |" & Myuserinfo & "| | | Dvbbs "

End IF

Response.Write Myuserinfo

Myuserinfo = Split (myuserinfo, "| | |")

......

End If

End Sub

After a successful user login, this function is used to read the user array and to judge some common information

Public Sub Getcacheuserinfo ()

Myuserinfo = Session (CacheName & "UserID")

UserID = CLNG (Myuserinfo (4))

MemberName = Myuserinfo (5)

Lastlogin = Myuserinfo (15)

If not IsDate (lastlogin) Then lastlogin = Now ()

Usergroupid = Cint (Myuserinfo (19))

...... Back code omitted


The two tests are in exactly the same way, so we can use either of these two to achieve our goal. Look at the part of its SQL statement:

Sql= "Select Userid,username,userpassword,useremail,userpost,usertopic,usersex,
Userface,userwidth,userheight,joindate,lastlogin,userlogins,lockuser,userclas
S,usergroupid,usergroup,userwealth,userep,usercp,userpower,userbirthday,userla
Stip,userdel,userisbest,userhidden,usermsg,ischallenge,usermobile,titlepic,usertit
Le,truepassword,usertoday "
Sql=sql+ "from [Dv_user] Where UserID =" & UserID


Javascript:window.open (THIS.SRC); Src= "/article/uploadpic/2006/8/27/200682723275512.gif" onload= "Javascript:if (this.width>screen.width-500) this.style.width=screen.width-500; "Align=baseline border=0>