C9静态文章发布系统漏洞

2010, May 11, 7:27 PM. 漏洞分析

Submitted by admin

作者:jshell

近来正在深入学习asp 到down.chinaz.com看源码都成习惯了

一直看到一个叫C9静态文章发布系统的程序只不过没仔细看过

今天下载回来一份看了下发现了问题在投票那里是一个flash投票系统

flash我不懂于是抓了个包看了下发现是通过add.asp提交投票 xml.asp

提供rss输出当读到这里的时候发现了问题代码如下:

<%
thisid=funstr(Trim(Request.QueryString("voteid")))
if thisid="" then
set rs=conn.execute("select top 1 * from plug_vote where oorc<>false order by id desc")
else
set rs=conn.execute("select * from plug_vote where id="&thisid)
end if
if rs.eof then response.Write("连接数据发生错误"):response.End()
conn.execute "update plug_vote set votevi=votevi+1 where id="&rs("id")
for i=1 to 5
if isnull(rs("cs_"&i)) then exit for
next

nowid=rs("id")

......

这里我们看下是如何接收变量传递进来的值的

thisid=funstr(Trim(Request.QueryString("voteid"))) trim过滤两边空格然后是funstr这个函数在包含文件里有个 fun/funlogic.asp 函数应该在这里打开这个文件

Function funstr(str)

  str = replace(str, "<", "<", 1, -1, 1)
  str = replace(str, ">", ">", 1, -1, 1)
     str = trim(str)
  str = replace(str,"'","‘")

funstr = str
    End Function
Function unfunstr(str)

  str = replace(str, "<","<", 1, -1, 1)
  str = replace(str, ">",">", 1, -1, 1)
     str = trim(str)
  str = replace(str,"‘","'")

unfunstr = str
    End Function