SQL Injection After BBSXP

Vulnerability Analysis

Order:
There is a movie named "all-in-one killer". The hero in the play is real. I like his personality very much!
He is very cool, I like! I don't know if you have watched this movie?
However, the story I want to explain today finds that it is a very common SQL penetration attack on the Internet. It is also the most basic.
The process is as follows:
1. Identify and analyze vulnerabilities.
2. Use the vulnerability to obtain the front-end head password.
3. Use the vulnerability to obtain the background password.
4. Add an announcement, pop-up!

Start work:

Download the latest bbsxp from the official bbsxp website.

Step 1: locate the vulnerability and analyze the vulnerability. This vulnerability exists in the asp file favorites. asp in the add to favorites function.
// *************************** Source code ************ ***************************************//
<%

If request. cookies ("username") = "" then
Error ("
You have not logged on to the community ")
End if

Select case request ("menu ")
Case "add"
If request. servervariables ("request_method") = "post" then
Url = request ("url ")
Else
Url = request. servervariables ("http_referer ")
End if
Conn.exe cute ("insert into favorites (username, name, url) values (" & request. cookies ("username") & "," & request ("name") & "," & url &")")
Error2 ("added to network favorites! ")

Case "del"
Conn.exe cute ("delete from [favorites] where username =" & request. cookies ("username") & "and id =" & request ("id ")&"")
End select
***** ***************************//

When you see the code, you must first register and use this function.
Then, the parameters submitted in this asp file include menu and id.
Let's take a look. When the submitted menu is del. Haha! What is called? It has vulnerabilities. Where is the vulnerability?
Conn.exe cute ("delete from [favorites] where username =" & request. cookies ("username") & "and id =" & request ("id ")&"")
The submitted id value is not filtered and directly added to the SQL statement.

1 2 Next Page

[Content navigation]
Page 1: Vulnerability Analysis	Page 1: Attack demonstration