BOBO online shop Mall Shopping System Vulnerability Analysis

Flaw0rs Blog

Version: BOBOShop V1.0 Style1
System: ASP + ACCESS
BOBO shopping management system is the most advanced Shopping System in China, using asp + fso technology; installation and debugging of silly programs; users do not need to consider system installation and maintenance; beautiful and friendly display shop; A variety of network security technologies are applied in the design. Customers can conveniently query and order products. Users can easily define various product information. The system selects a powerful database to store various types of information; the system supports a variety of browsers; the function modules are clear, practical, and powerful; the system has good scalability and upgrade; the powerful online payment system and order system;
Comprehensive Security Processing: database anti-download processing, CONN prevention of brute-force database processing, prevention of cross-site scripting attacks, prevention of SQL injection attacks, prevention of offline browsing tools, verification code for background login, MD5 encryption for member passwords prevents access from unknown IP addresses and software attacks, uses MD5 encryption for administrator passwords, filters SQL Injection code and HTML code protection, and monitors data source security, cross-site Scripting prevention, administrator login day to record, invalid operation code day to record
Vulnerability 1: Message cross-site
The website message page is gbook. asp. Let's take a look at the problematic code:
Function HTMLEncode2 (fString)

FString = Replace (fString, CHR (13 ),"")

FString = Replace (fString, CHR (10) & CHR (10), "</P> <> ")

FString = Replace (fString, CHR (10), "<BR> ")

HTMLEncode2 = fString

End function
Set rs = server. CreateObject ("adodb. recordset ")
Rs. open "select * from shop_fk", conn, 1, 3
Rs. addnew
Rs ("fksubject") = trim (request ("fksubject "))
Rs ("fkleixing") = request ("fkleixing ")
Rs ("fkcontent") = htmlencode2 (trim (request ("fkcontent ")))
Rs ("fkusername") = trim (request ("fkusername "))
Rs ("fkemail") = trim (request ("fkemail "))
Rs ("fktel") = trim (request ("fktel "))
Rs ("fklaizi") = trim (request ("fklaizi "))
Rs ("fkdate") = now
Rs ("fkip") = Request. ServerVariables ("remote_addr ")
Rs. update
Rs. close
Set rs = nothing
The author first defines an HTML filter function, HTMLEncode2, but this function does not filter <and>. As to whether cross-site filtering can be successful, check whether the file for the message is further filtered in the background, because the message is sent directly to the Administrator. So let's take a look at the background to view the message file viewfk. asp. The problematic code is as follows:
<Table width = "80%" border = "0" cellspacing = "1" cellpadding = "0">
<Tr>
<Td align = "center">
<B> <% = trim (rs ("fksubject") %> </B>
</Td>
</Tr>
<Tr>
<Td>
<% = Trim (rs ("fkcontent") %> <br>
<% = "Posting time:" & rs ("fkdate") %>
</Td>
</Tr>
</Table>
We can clearly see that fksubject and fkcontent only filter left and right spaces, so that we can achieve cross-site success.
We can write the cross-site test code <script> alert (/xss/) </script> In the message content.

When the Administrator checks our message, the system successfully executes our cross-site test code. The effect is as follows:

 

As for the Cross-Site advanced applications, we can see that everyone has played a role.

Vulnerability 2: cookie Spoofing

Vulnerability file: 1. The huansuan. asp Vulnerability code is as follows:
<%
If request. Cookies ("BOB") ("username") = "" then
Response. Redirect "user. asp"
Response. End
End if
............................... Code omitted
%>
2. The gouwu. asp Vulnerability code is as follows:
Dim bookid, username, action
Action = request. QueryString ("action ")
If request. Cookies ("BOB") ("username") <> "" then
Username = trim (request. Cookies ("BOB") ("username "))
Else
If request. Cookies ("BOB") ("dingdanusername") = "" then
Username = now ()
Username = replace (trim (username ),"-","")
Username = replace (username ,":","")
Username = replace (username ,"","")
Response. Cookies ("BOB") ("dingdanusername") = username
Set rs = server. CreateObject ("adodb. recordset ")
Rs. open "select * from [user]", conn, 1, 3
Rs. addnew
Rs ("username") = username
Rs ("niming") = 1
Rs. update
Rs. close
Set rs = nothing
Else
Username = request. Cookies ("BOB") ("dingdanusername ")
End if
End if

The cookie information is as follows:
Reglx % 3D = 1 & yucun = 0 & jifen = 0 & username = flaw0r®Lx = 1 & jiaoyijine = 0
Usercookies = 1 & userid = 4439 & userhidden = 2 & password = 965eb72c92a549dd & userclass = 1 & username = flaw0r
We can easily forge information. Reglx = 1 is a common user, and reglx = 2 is a VIP user.
3. dingdan. asp
<% If request. Cookies ("BOB") ("username") = "" then
Response. write "<script. language = javascript> alert (Sorry, you have not logged on !); History. go (-1); </script>"
Response. End
End if %>
This system also has many files with the aforementioned cookie spoofing vulnerability, which is not listed here.