The process of uploading a CMS file is improper, so that you can control the file name and upload any file.
First, check the upload page:
<Html>
<Head>
<Title> upload images </title>
<Meta http-equiv = "Content-Type" content = "text/html; charset = gb2312">
<Script language = "JavaScript">
Function check (){
If (document. forms [0]. file. value = "")
{
Alert ("select the image path! ");
Document. forms [0]. file. focus ();
Return false;
}
Return true;
}
</Script>
<Style type = "text/css">
<! --
Body, td, th {
Font-family: Arial, Helvetica, sans-serif;
Font-size: 14px;
}
A: link {
Text-decoration: none;
}
A: visited {
Text-decoration: none;
}
A: hover {
Text-decoration: none;
}
A: active {
Text-decoration: none;
}
Body {
Margin-left: 0px;
Margin-top: 0px;
Margin-right: 0px;
Margin-bottom: 0px;
}
-->
</Style>
<Body>
<Table width = "296" height = "38" border = "0" align = "center" cellpadding = "0" cellspacing = "0" class = "t12">
<Form action = "upload_ OK .asp" method = "post" enctype = "multipart/form-data">
<Tr>
<Td align = "center"> <br>
<Strong> image path: </strong>
<Input type = "file" name = "file">
<Br>
<Br>
<Input type = "submit" name = "Submit" value = "Upload" onClick = "return check ();">
<Input name = "textField" type = "hidden" id = "textField" value = "<% = Trim (request (" textField ") %>">
<Input name = "filename" type = "hidden" id = "filename" value = "<% = Trim (Request (" imgname ") %>">
<Input name = "action" type = "hidden" id = "action" value = "<% = Trim (Request (" action ") %>">
<Input name = "imgtype" type = "hidden" id = "imgtype" value = "<% = Request (" imgtype ") %>"> </td>
</Tr>
</Form>
</Table>
</Body>
</Html>
Pass it to upload_ OK .asp for processing. Check upload_ OK .asp source code:
On error goto 0' close on error resume next
Dim desFolder: desFolder = server. mappath ("../pic ")
Dim rs, filename, ext, imgname, imgname2, Y, M, D, Shuoming
Ext = "jpg"
If Trim (ourRequest. Form ("filename") = "" then
Y = Year (Now)
M = Month (Now)
D = Day (Now)
H = Hour (Now)
M = Minute (Now)
S = Second (Now)
Imgname = Y * 1000000000 + M * 10000000 + D * 100000 + H * 10000 + M * 1000 + S * 100 + 1
Set rs = server. CreateObject ("ADODB. Recordset ")
Rs. open "select top 1 * from pic where left (imgname, 8) = '" & left (imgname, 8) & "'order by imgname desc", conn, 1, 1
If Not (rs. Eof And rs. Bof) Then
Imgname2 = CCur (rs ("imgname") + 1
Else
Imgname2 = imgname
End If
Filename = imgname2 & ". jpg"
Else
Filename = Trim (ourRequest. Form ("filename "))
End If
Call ourRequest. File (0). SaveAs (desFolder, filename)
If the file name is blank, the file will be named after the suffix ". jpg" related to the expiration time. If the file name is not blank, the file will be named after the file name.
Let's take a look at the source file after the upload page is executed:
<Table width = "296" height = "38" border = "0" align = "center" cellpadding = "0" cellspacing = "0" class = "t12">
<Form action = "upload_ OK .asp" method = "post" enctype = "multipart/form-data">
<Tr>
<Td align = "center"> <br>
<Strong> image path: </strong>
<Input type = "file" name = "file">
<Br>
<Br>
<Input type = "submit" name = "Submit" value = "Upload" onClick = "return check ();">
<Input name = "textField" type = "hidden" id = "textField" value = "bigpics">
<Input name = "filename" type = "hidden" id = "filename" value = ">
<Input name = "action" type = "hidden" id = "action" value = "add">
<Input name = "imgtype" type = "hidden" id = "imgtype" value = "bigpics"> </td>
</Tr>
</Form>
</Table>
The filenamevariation is always empty, and all the files are processed with the suffix ". jpg" at the same time.
Proof of vulnerability:
We save the upload page source file as an html file, change form action = "http://XXXX.XXXX/upload_ OK .asp"
Change the value = "one. asp" of the filename variable, open the upload page, save the trojan as .jpg, and upload it on a local page. The Trojan is uploaded to the Pic directory named one. asp.
Solution:
Modify the user authentication on the upload page;
Modify the file name processing process;
Modify the execution permission of the file upload directory;
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
