Cms SQL Injection

Wave by wave latest x1.5sql injection address http://demo.zoomla.cn/Customer.aspx source code is as follows

Protected void Page_Load (object sender, EventArgs e) {if (base. Request. QueryString ["type"]! = Null) {if (base. request. queryString ["type"] = "Seat") {this. getSeat ();} if (base. request. queryString ["type"] = "add") {this. setInfo (base. request. form. toString ();} bool flag1 = base. request. queryString ["type"] = "answer"; if (base. request. queryString ["type"] = "getservice") & (base. request. queryString ["uid"]! = Null) {this. getServerInfo (base. request. queryString ["uid"]. toString (), base. request. cookies ["Provisional"] ["Uid"]); // follow up} if (base. request. queryString ["type"] = "OnlineUsers") {this. getOnlineUsers ();} bool flag2 = base. request. queryString ["type"] = "CallMe"; if (base. request. queryString ["type"] = "msg") {this. getMsg (); // follow up} this. delUser () ;}} private void GetMsg () {StringBuilder builder = new StringBuilder (); DataTable table = this. bcsbll. select_Where ("CS_Type = 0 and CS_OID =" + base. request. cookies ["Provisional"] ["Uid"], "DISTINCT CS_SendID, CS_SendName", ""); // injection not processed (int I = 0; I <table. rows. count; I ++) {builder. append (string. concat (new object [] {table. rows [I] ["CS_SendID"], ",", table. rows [I] ["CS_SendName"], ";"}) ;}string s = builder. toString (); if (s. endsWith (";") {s = s. substring (0, s. length-1);} base. response. write (s );}

 

Another

Private void GetServerInfo (string uid, string sessid) {DataTable customerByUid = this. bcsbll. getCustomerByUid (DataConverter. CLng (uid), sessid); // follow up StringBuilder builder = new StringBuilder (); if (! String. IsNullOrEmpty (uid )&&! String. isNullOrEmpty (sessid) {for (int I = 0; I <customerByUid. rows. count; I ++) {if (customerByUid. rows [I] ["CS_OID"]! = Null) & (sessid = customerByUid. rows [I] ["CS_OID"]. toString () & (customerByUid. rows [I] ["CS_SendID"]. toString () = sessid) {builder. append (string. concat (new object [] {customerByUid. rows [I] ["CS_AddTime"], "", customerByUid. rows [I] ["CS_CtoName"], "says: <br/> & nbsp;", customerByUid. rows [I] ["CS_Context"], "<br/>"});} else {builder. append (string. concat (new object [] {customerByUid. row S [I] ["CS_AddTime"]. toString (), "", customerByUid. rows [I] ["CS_SendName"], "say to you: <br/> & nbsp;", customerByUid. rows [I] ["CS_Context"], "<br/>"}) ;}} base. response. write (builder. toString ();} public DataTable GetCustomerByUid (int id, string sessid) {string strSQL = ""; if (id> 0) {string str2 = strSQL; strSQL = str2 + "(CS_SendID =" + id. toString () + "or CS_Ctouid =" + id. toString () + ")";} If (! String. isNullOrEmpty (sessid) {strSQL = strSQL + "and CS_OID = '" + sessid + "'"; // injection not processed} DataTable dt = this. selectWhere (strSQL, "CS_ID, CS_Context, CS_SendName, CS_SendID, CS_CtoName, CS_AddTime, CS_OID", "CS_AddTime asc"); this. updateType (dt, id, sessid); return dt ;}

 

Access http://demo.zoomla.cn/Add cookie value then access http://demo.zoomla.cn/Customer.aspx? Type = msg or access http://demo.zoomla.cn/Customer.aspx? Type = getservice & uid = 1 cookie structure:

  Solution:Process cookies