The principle of uploading files and the code realization of the attack

Recently a period of busy, no time for the organization to make contributions (really is no strength, hehe). Just a little while ago. * * Daner, "the current popular BBS security comparison," a text see: http://wvw.ttian.net/forum/viewtopic.php? id=269) to persuade the network forum out of an upload arbitrary file loopholes, at that time did not understand how. But I see the recent NB Forum in the discussion about this aspect of the problem, the study, found that the loophole is really there, and very serious, with small * words is DVBBS7.0 SP2 below. Although some people already know the method of attack, there are still some problems. Below I will explain this loophole of the network. (I don't know if it will be scolded because it's too big a loophole).
We first look at the Moving Network forum upload files related code:
' =========== no component upload (UPLOAD_0) ====================
Sub Upload_0 ()
Set upload=new upfile_class ' Build upload Object
Upload. GetDate (int (forum_setting (56)) *1024) ' Get uploaded data, unlimited size
Icount=0
If Upload.err > 0 Then
Select Case Upload.err
Case 1
Response.Write "Please select the file you want to upload first [<a href=# onclick=history.go ( -1) > re-upload </a>]"
Case 2
Response.Write "Picture size exceeds Limit" &forum_setting & "K [<a href=# onclick=history.go ( -1) > re-upload </a>]"
End Select
Exit Sub
Else
Formpath=upload.form ("filepath")
"Add (/) to the directory
If Right (formpath,1) <> "/" Then formpath=formpath& "/"
For every formName in Upload.file ' lists all uploaded files
Set File=upload.file (formName) ' generates a File object
If File.filesize<100 Then
Response.Write "Please select the picture you want to upload first [<a href=# onclick=history.go ( -1) > re-upload </a>]"
Response.End
End If
Fileext=lcase (file. Fileext)
If Checkfileext (fileext) =false Then
Response.Write "file format is incorrect [<a href=# onclick=history.go ( -1) > re-upload </a>]"
Response.End
End If
Randomize
Rannum=int (90000*RND) +10000
Filename=formpath&year (now) &month-&day (now) &hour (now) &minute (now) &second (now) & rannum& "." &fileext