Zhi Rui School website management system v1.3 second Vulnerability

Links blog:Http://hi.baidu.com/linkhack

========================================================== ==============================================

While squatting in the restroom, I looked at Cheng Mei's article on Anti-injection in the anti-black market. The idea is expanded to think of this system. A previous cave can be used, but it can also be used as follows:

Anti-injection:

<%
Dim SQL _inj, SQL _Get, SQL _Data, SQL _Post
SQL _inj = split (DataNsql, "| ")
If Request. QueryString <> "Then
For Each SQL _Get In Request. QueryString
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. QueryString (SQL _Get), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = javascript> alert (Note: Do not submit illegal requests! Http: // Www.ZhiRui.net); history. back (-1) </Script>"
Response. end ()
End if
Next
Next
End If
If Request. Form <> "" Then
For Each SQL _Post In Request. Form
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. Form (SQL _Post), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = javascript> alert (Note: Do not submit illegal requests! Http: // Www.ZhiRui.net); history. back (-1) </Script>"
Response. end ()
End if
Next
Next
End if
%> <%
Dim SQL _inj, SQL _Get, SQL _Data, SQL _Post
SQL _inj = split (DataNsql, "| ")
If Request. QueryString <> "Then
For Each SQL _Get In Request. QueryString
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. QueryString (SQL _Get), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = javascript> alert (Note: Do not submit illegal requests! Http: // Www.ZhiRui.net); history. back (-1) </Script>"
Response. end ()
End if
Next
Next
End If
If Request. Form <> "" Then
For Each SQL _Post In Request. Form
For SQL _Data = 0 To Ubound (SQL _inj)
If instr (Request. Form (SQL _Post), SQL _Inj (SQL _DATA)> 0 Then
Response. Write "<Script Language = javascript> alert (Note: Do not submit illegal requests! Http: // Www.ZhiRui.net); history. back (-1) </Script>"
Response. end ()
End if
Next
Next
End if
%>

Core Statement:

If instr (Request. Form (SQL _Post), SQL _Inj (SQL _DATA)> 0 Then ..

If instr (Request. QueryString (SQL _Get), SQL _Inj (SQL _DATA)> 0 Then ..

Use the instr function to determine whether it is a character. I thought it was safe. If the lower-case characters are submitted, then they are naturally filtered out.

If I submit uppercase and lowercase characters, for example, select => SelEcT ,. Asp has a function called Lcase to convert real parameters to lowercase letters.

Lcase is not used here, so we can use case-insensitive bypass. So you don't need to inject trouble with the cookies I mentioned earlier.

Directly ignore anti-injection ~