Dvbbs 8.2 SQL Injection Vulnerability Analysis

Vulnerability announcement: http://seclists.org/bugtraq/2008/May/0330.html Method of exploits: a typical SQL injection vulnerability, as described in the announcement Password = 123123 & codestr = 71 & cookiedate = 2 & userhidden = 2 & comeurl = index. asp & submit = % u7acb % u5373 % u767b % u5f55 & ajaxpost = 1 & AM

Vulnerability analysis: the mobile network is also a relatively old program in the ASP field. This time there is a low-level error in the new version 8.2. The vulnerability code is about 118 lines in login. asp. ...... Username = trim (dvbbs. checkstr (Request ("username "))) If ajaxpro then username = Unescape (username) ...... The obtained username is checked first and then decoded by Unescape. As a result, the urlencode mode can be used for any checks, which is similar to the injection caused by urldecode in PHP, for example, you can use % 2527 to submit. Patch solution: patch is also very simple. Change the above Code ...... Username = trim (dvbbs. checkstr (Request ("username "))) If ajaxpro then username = trim (dvbbs. checkstr (Unescape (username ))) ......