Oblog 4.5-4.6 access & amp; mssql getshell 0day

Impact scope: 4.5-4.6
Vulnerability requirement: IIS6.0 \ Enable Member
Mining Author: henry
 
Absolutely original, low technical content, but wide scope of impact ..
 

Vulnerability files:
AjaxServer. asp (row 372)
Log_filename = Trim (Request ("filename") // The custom file name is not filtered out.
 
AjaxServer. asp (259 rows) (key)
If (oblog. chkdomain (log_filename) = False And log_filename <> "") and isdraft <> 1 Then oblog. adderrstr ("the file name is not standard And can only contain lower-case letters and numbers! ")
 
Logic error. If one of the conditions is not met, skip this step. See:
 
Row 206 isdraft = Int (Request ("isdraft") // controllable
 
Isdraft = 1 www.2cto.com is skipped
 
Vulnerability exploitation:
 
Register a member and publish a log.
Modify log, advanced options, file name here write abcdefg, content is a Trojan source code. Capture the package and save it.
Modify form data, change filename to a. asp; x, isdraft parameter to 1, and submit the form.
⒋ Go back to the blog Management page and select "resend log". The log address is the SHELL address.
 
Tips: If the blog directory is unavailable, you can control filename =.../../data/a. asp; x
 
Oblog 4.5-4.6 access & mssql getshell 0day