Registration Upload Vulnerability and repair for a liquor network member

Release date: 2011-01.29
Author: xiaokis

Vulnerability Type: File Upload
Vulnerability description:

File: sub_upload.asp

01 <! -- # Include file = "UPLOAD. INC" -->

02 <% if session ("admin_name") = "" and Session ("ME_name") = "" then %>

03 <style type = "text/css">

04 <style type = "text/css">

05 <! --

06 body, td, th {

07 font-size: 12px;

08}

09 -->

10 </style>

11 <link href = "css/01.css" rel =" stylesheet "type =" text/css ">

12 <style type = "text/css">

13 <! --

14 body {

15 background-color: #333333;

16}

17 -->

18 </style>

19 sorry, you are not a member and will not perform this operation!

20 <% else %>

21 <%

22 dim arr (3)

23 dim upload, file, formName, formPath, iCount, filename, fileExt, I

24 set upload = new upload_5xSoft

25

26 formPath = "" path for storing images: add the uploadimages folder under the product directory after the directory (/)

27

28 list all uploaded files

29 for each formName in upload. file

30 set file = upload. file (formName)

31 if file. filesize> 0 then

32 if file. filesize & gt; 10000000 then

33 response. write "<font size = 2> the image size exceeds the upper limit [<a href = #

34

35 onclick = history. go (-1)> re-upload </a>] </font>"

36 response. end

37 end if

38 fileExt = lcase (right (file. filename, 4 ))

39 if fileExt <> ". jpg" then

40 response. write "<font size = 2> file format restrictions [<a href = # onclick = history. go (-1)> please upload it again

41

42 </a>] </font>"

43 response. end

44 end if

45 end if

46

47 filename = year (now) & month (now) & day (now) & hour (now) & minute (now) & second (now)

48

49 & file. FileName

50

51 if file. FileSize> 0 then if FileSize> 0, file data exists.

52 file. SaveAs Server. mappath (formpath & filename) save the file

53 response. write file. FilePath & file. FileName & "(" & file. FileSize & ") =>

54

55 "& formPath & File. FileName &" uploaded successfully"

56 response. write "uploaded successfully <a href = # onclick = history. go (-1)> Please return </a>"

57

58 end if

59 set file = nothing

60 next

61 set upload = nothing

62 Response. Write "<script> parent. add. picUrl. value =" & FileName & "</script>"

63%>

64 <% end if %>

File Upload is a custom name, so the IIS parsing vulnerability is exploited.

 

Usage method: first register the user, then fill in the yellow page and upload x.asp;.jpg
Upload page upImgFile/upload.htm
Submit page: upImgFile/sub_upload.asp
The uploaded file exists in the directory: upImgFile

Proof of vulnerability: http://www.xxx.com/upImgFile/2011129204147jiami.asp;.jpg

Solution: temporarily restrict upload directory script execution or enhance file filtering.