ShyPost: XSS injection in the enterprise website management system V4.3 and webshell injection in the background

① Injection Vulnerability
 
 
 
1. Vulnerability file: Aboutus. asp
%>
<! -- # Include file = "Inc/SysProduct. asp" -->
<% Title = Trim (request ("Title "))
Set rs = Server. CreateObject ("ADODB. Recordset ")
SQL = "select Content from Aboutus where Title = '" & Title &"'"
Rs. open SQL, conn, 1, 3
%> Www.2cto.com
Not filtered
 
2. Vulnerability file: ProductShow. asp
<%
ShowSmallClassType = ShowSmallClassType_Article
Dim ID
ID = trim (request ("ID "))
If ID = "" then
Response. Redirect ("Product. asp ")
End if
 
SQL = "select * from Product where ID =" & ID &""
Similar to the above
 
 
 
② Background XSS Vulnerability
 
 
Write the xss code in the online message at the front-end. The code can be successfully executed in the background.
Vulnerability file: FeedbackSave. asp
Cause: not filtered
 
③ Editor Vulnerability
 
 
Editor Version: [MY motivation] HTML online editor
Vulnerability code:
If fileEXT = "asp" or fileEXT = "asa" or fileEXT = "aspx" then
EnableUpload = false
End if
No space is filtered for uploading. you can log on to the background and use the NC counterfeit package to break through the upload. Finally, you can use this vulnerability to get the webshell.

Author: invincible creative medicine from: 90sec Forum