Baigo bbs & amp; baigo cms Analysis

 

1. user_reg.asp

'Register

Case "user_reg_do"

 

User_name = trim (request. form ("user_name "))

User_pass = trim (request. form ("user_pass "))

User_pass_again = trim (request. form ("user_pass_again "))

User_mail = trim (request. form ("user_mail "))

User_pass_question = trim (request. form ("user_pass_question "))

User_pass_answer = trim (request. form ("user_pass_answer "))

User_sex = trim (request. form ("user_sex "))

User_www = trim (request. form ("user_www "))

User_sign = trim (request. form ("user_sign "))

User_face = trim (request. form ("user_face "))

User_qq = trim (request. form ("user_qq "))

User_msn = trim (request. form ("user_msn "))

%>

Simple space Filtering

If instr (user_name, "")> 0 or instr (user_name, "#")> 0 or instr (user_name, "'")> 0 or instr (user_name, "|")> 0 or instr (user_name, "")> 0 or instr (user_name, "")> 0 or Instr (user_name, "%")> 0 or Instr (user_name, "&")> 0 or Instr (user_name, "percent")> 0 or Instr (user_name, "percent")> 0 or Instr (user_name, "percent")> 0 or Instr (user_name, "percent")> 0 or Instr (user_name, "")> 0 or Instr (user_name, "+")> 0 or Instr (user_name, "=")> 0 or Instr (user_name, "'")> 0 then

Session ("message") = "<li> the user name cannot contain special characters </li>"

Session ("message") = session ("message") & "<li> <a href =" "javascript: history. back (); ""> return </a> </li>"

No check; you can register an account of duos. asp; 1 with a semicolon.

A feature is that the registered member uploads an avatar to save the image based on his/her name.

The account registered with duos.asp;1is automatically saved as duos.asp;1.jpg (this vulnerability can be exploited by IIS6.0)

 

 

2.

There are many XSS. This has a great impact on the forum.

 

Source: http://www.t00ls.net/thread-19635-1-1.html