Weier article system v1.51 Mandatory vulnerability Removal

Author: jshell

This system has been analyzed before. Today we see an updated version, so we downloaded it and read it.

The previous vulnerabilities were completed, but the new one was upload, and the other was background injection.

First, the authentication file is not included in/manage/video/upfile_soft.asp.

Gl. asp, but the code is not strictly written, causing serious vulnerabilities. Check the Code:

If fileEXT = "asp" or fileEXT = "asa" or fileEXT = "aspx" then
Response. the write "<font size = 2> file format is incorrect [<a href = # onclick = history. go (-1)> re-upload </a>] </font>"
Response. end
End if

The mistake is too low. We can upload cer php and other files to achieve the evil purpose:

Open http: // localhost/manage/video/upload_soft.asp and upload the cer directly.

The same vulnerability exists in the down folder.

It is estimated that the author is too careless. In many places, the background authentication file does not contain any content, and the injection vulnerability also exists.

It's a coincidence! Vulnerability found in/manage/ClassModifySmall. asp

Construct an http: // localhost/manage/ClassModifySmall. asp? SmallClassID = 1

The injection tool can run. The foreground security cannot hide the background's simplicity.