126oo CMS post-system update Vulnerability

The updated code modifies the background Bypass Method.
Use Random Functions

Code:
Sub chklogin
Dim SQL, rs
Dim M_Name, loginValidate
M_Name = GetCookie ("AdminName ")
M_Name = replace (M_Name ,"","")
On error resume next
Set rs = Database. GetRecordDetail ("Tbl_Manager", "M_Name =" & M_Name &"")

LoginValidate = md5 (rs ("M_Random") & rs ("M_Name") & rs ("M_ID") Here we use a random number + User Name + id.

If err then
SetCookie "check", "", 30
Writeend "<script> top. location. href = index. asp? Action = login; </script>"
End if

If GetCookie ("check") <> loginValidate then is not equal, the logon page is returned.
SetCookie "check", "", 30
Writeend "<script> top. location. href = index. asp? Action = login; </script>"
End if
You can log on here.
End Sub

 

After analysis, we will try to inject the injection, because if we can get all the content of the above three conditions, we can directly log on to the background, because we don't have time to look at it in detail, so I just watched it and found that he used functions to set query updates and so on. So I won't read it. Time is limited.

Let's just talk about this problem. ServerVariables in the getip function is definitely not filtered, so we can submit the injection. You can find the injection vulnerability by yourself.

Code:
Function GetIP ()
Dim addr, x, y
X = Request. ServerVariables ("HTTP_X_FORWARDED_FOR ")
Y = Request. ServerVariables ("REMOTE_ADDR ")
Addr = IIF (isN (x) or lCase (x) = "unknown", y, x)
If InStr (addr, ".") = 0 Then addr = "0.0.0.0"
GetIP = addr
End Function