Carefree shopping system SQL Injection Vulnerability

Alimail love S Blog http://www.virusest.com/
Vulnerability name: carefree shopping system SQL Injection Vulnerability
Release date:
Affected Versions: No worries Shopping System ASP fashion edition Build091025, no worries Shopping System ASP general free version (Build090325) (Other versions are not tested)
Vulnerability Description: The shangpintj. asp bookid variable is used as a filter and brought to the database for query. (Two versions of kill)
Gongqiu_view.asp gq_id is a filter that is imported into the database for query, resulting in injection. (Only free version exists)
Shangpintj. asp page issue code:
Bookid = request. QueryString ("id ")
Action = request. QueryString ("action ")
If action = "save" then
Set rs = server. CreateObject ("adodb. recordset ")
Rs. open "select * from BJX_goods where bookid =" & bookid, conn, 1, 1
Bookname = rs ("bookname ")
Rs. close
Set rs = nothing

Code of the gongqiu_view.asp page:
Gq_id = request ("gq_id ")
Set rs = server. createobject ("adodb. recordset ")
Rs. open "select * from bjx_gongqiu where gq_check = 1 and gq_id =" & gq_id & "", conn, 1, 3
The usage is as follows:
First, Google: inurl: gongqiu_view.asp? Gq_id is easy to use and handed over directly to the tool. Manually Add Table Name BJX_admin
2. The use of the shangpintj. asp page, Google: inurl: shangpintj. asp, can be said to be capable of killing multiple systems. Open the web page is a product recommendation submission form. We can fill in the form and click send. At this time, some systems will prompt that the sending is successful, and some systems will prompt that the sending fails. Copy the address bar of the browser.
Http://www.xxx.net/shangpintj.asp? Action = save & id = 186 to the tool for injection. When the table name shop_admin was added to the test, some people could guess the table name but could not guess the field. When you are a few people, you will not download the table names from other systems. This file is included in the program of the dynamic shopping business platform, and many online store systems copy this page without processing it.