QShopNet SQL injection vulnerability and repair solution of qibo Shopping System

 
Release date: 2011-04.02
Author: anytime

Affected Versions: V2011.0316
Http://www.qianbo.com.cn/

Vulnerability Type: SQL Injection

Vulnerability Description: The page is not strictly filtered, leading to the SQL injection vulnerability.

Vulnerability file: votelist. asp has not been filtered.
<! -- # Include file = "Conn. Asp" -->
<! -- # Include file = "Const. Asp" -->
<! -- # Include file = "../FunctionSystem. Asp" -->
<%
Response. Expires = 0
Addr0 = request. servervariables ("http_host ")
Addr1 = request. servervariables ("url ")
Addr1 = Replace (addr1, "VoteList. Asp ","")
Addr = "http: //" & addr0 & addr1
Set rs = server. CreateObject ("adodb. recordset ")
If request ("id") = "" Then
Set rs = conn. Execute ("select top 1 * from QShop_voteclass order by id desc ")
Else
Set rs = conn. Execute ("select * from QShop_voteclass where id =" & request ("id "))
End If
Title = rs ("title ")
Style = rs ("style ")
Classid = rs ("id ")
Rs. Close
SQL = "select * from QShop_vote where class =" & classid
Rs. Open SQL, conn, 3, 1
%> Vote = ""
Vote = vote + "<table cellspacing = 0 cellpadding = 0 width = 100% border = 0>"
Vote = vote + "<form action = <% = weburl %> PubLication. Asp? Classid = <% = classid %> & style = <% = style %> method = post target = _ blank>"
Vote = vote + "<tr>"
Vote = vote + "<td> <table cellspacing = 0 cellpadding = 0 width = 100% border = 0>"
Vote = vote + "<tr>"
Vote = vote + "<td>"
Vote = vote + "<tr>"
Vote = vote + "<td valign = top> <table cellspacing = 0 cellpadding = 0 width = 100% border = 0>"
Vote = vote + "<tr> <td width = 100% height = 25> <p align = center> <% = title %> </td> </tr>"
<%
Do While Not rs. EOF
%>
Vote = vote + "<tr>"
Vote = vote + "<td width = 100%> <input type = <% = style %> name = voted value = <% = rs (" id ") % >>>< % = rs ("vote") %> </td>"
Vote = vote + "</tr>"
<%
Rs. movenext
Loop
%>
Vote = vote + "<tr>"
Vote = vote + "<td width = 100% valign = bottom align = center> <input type = submit value = voting name = vote> <input name = see type = button value = View result onClick = javascript: window. open (<% = weburl %> ShowVote. asp? Classid = <% = classid %>) target = _ blank/> </td>"
Vote = vote + "</tr>"
Vote = vote + "</table> </td>"
Vote = vote + "</tr>"
Vote = vote + "</table> </td>"
Vote = vote + "</tr>"
Vote = vote + "</form>"
Vote = vote + "</table>"
<%
Rs. Close
Set rs = Nothing
Conn. Close
Set conn = Nothing
%>
Document. write (vote)

Usage:

Construct votevotelist. asp? Id = voting address
Access Field
Qshop_admin
F_username
F_id
F_password

Solution: We recommend that you filter the SQL query code.