sqlmap cookie injection

There are two main types of ASP acquisition parameters:Request.QueryString (Get) or Request.Form (POST)We sometimes write Id=request ("ID") to simplify the code, because there is a problem with the writing ... The original Web service reads data like this:Take the data in get, no more data in the post, and fetch the data from cookies! That's what I found out.The usual anti-injection system, he detects the data in Get and post, if there are special ch

Catalog1 . Vulnerability Description 2 . Vulnerability trigger Condition 3 . Vulnerability Impact Range 4 . Vulnerability Code Analysis 5 . Defense Methods 6. Defensive thinking1. Vulnerability descriptionRelevant Link:2. Vulnerability Trigger Condition3. Vulnerability Impact Range4. Vulnerability Code Analysis5. Defense Methods/inc/check_sql.aspOn Error Resume Next. " '" Chk_badword=split (Query_badword,"∥") for each fy_get in Request.Cookies For i=0 to Ubound (chk_badword) If Instr

= "SELECT did, lng, pid, mid, aid, tid, sid, fgid, linkdid, isclass, islink, ishtml, ismess, isorder, purview, recommend, tsn, title, longtitle, color, author, source, pic, link, oprice, bprice, click, addtime, template, filename, filepath FROM $ db_table WHERE $ db_where "; // dynamically construct SQL statements$ Rs = $ this-> db-> query ($ SQL); // directly bring in the query to directly obtain the value of cookies ['ecisp _ order_list '] without filtering, it is directly used to construct a

Release date:Updated on: 2013-04-10 Affected Systems:ESPCMSDescription:--------------------------------------------------------------------------------ESPCMS is an enterprise website management system developed based on LAMP.ESPCMS has a cookie injection vulnerability in an in_list function. The problem code obtains the value of cookies ['ecisp _ order_list '], which is directly used to construct SQL state

ShowSmallClassType = ShowSmallClassType_ArticleDim IDID = trim (request ("ID "))If ID = "" thenResponse. Redirect ("cg_Product.asp ")End if SQL = "select * from cg_Product where ID =" ID ""Set rs = Server. CreateObject ("ADODB. Recordset ")Rs. open SQL, conn, 1, 3If rs. bof and rs. eof thenResponse. write ""ElseRs ("Hits") = rs ("Hits") + 1Rs. update%> Only get post is filtered and cookie injection exists.