Wangqu Online Shopping System flagship version v6.7 persistent XXS and Permission Bypass

I haven't played the audit for a long time, so I downloaded the source code and found an xss to play ....!!!

Vulnerability Type: Persistent xss

Store xss in the Registry

Code:

rs("username")=trim(request("username"))rs("userpassword")=md5(trim(request("userpassword")))rs("useremail")=trim(request("useremail"))rs("quesion")=trim(request("quesion"))rs("answer")=md5(trim(request("answer")))rs("userzhenshiname")=trim(request("userzhenshiname"))rs("shouhuodizhi")=trim(request("shouhuodizhi"))rs("youbian")=trim(request("youbian"))rs("oicq")=trim(request("oicq"))rs("usertel")=trim(request("usertel"))rs("songhuofangshi")=trim(request("songhuofangshi"))rs("zhifufangshi")=trim(request("zhifufangshi"))rs("adddate")=now()rs("lastlogin")=now()rs("logins")=1rs("reglx")=1rs("jifen")=0rs("jiaoyijine")=0rs("sex")=1rs("userlastip")=Request.ServerVariables("REMOTE_ADDR")

Note: The preceding variables only filter spaces and do not filter xss code.


Vulnerability Type: Permission Bypass

Code:
Request. cookies ("Cnhww") ("username ")

Note: The above code exists on the user. asp page, and this Code also exists on some other pages. The above Code uses cookies to retrieve the user name without being judged.

Whether the user name exists. Instead, the username obtained by cookie is used directly! It is used directly no matter what the cookie gets, and even xss code is executed ~!
PS: we can find a known user and use the Firefox plug-in to modify the username value.




PS: Okay. Let's test it locally. We use xss to enter the background. First, register an account and fill in the xss code in "your real name" on the registration page, then register directly (

Others ). OK. log on to the background using the management account and go to registration. The real name is empty. Actually, the cookie has arrived. Let's go to the cookie website .. See it.

... Hey, let's get the cookie we intercepted and try it... Hey, go in ....!!!


Postscript: in fact, this system still has injection... but... what are you doing ~!!!