樱花浪子'S BLOG

作者：樱花浪子[I.S.T]
来源：http://www.hacklu.net
申明：转载请注名版权,此文版权归1st和樱花浪子所有. ！



 近日无事，从源码之家下了一套飘易留言本系统 v4.0读了一下代码，发现了两个漏洞。

一、暴库
直接在网址后台加个：inc/conn.asp可以暴出数据库路径。图一。




二、跨站
在addok.asp(处理用户留言的文件)的2行到58行代码如下：

<%
dim name,sex,title,qq,email,homepage,qiaoqiaohua,content,repcontent,ip,verifycode
name=replace(trim(request.form("name")),"'","")
sex=request.form("sex")
title=replace(trim(request.form("title")),"'","")
qq=replace(trim(request.form("qq")),"'","")
email=replace(trim(request.form("email")),"'","")
homepage=replace(trim(request.form("homepage")),"'","")
qiaoqiaohua=request.form("qiaoqiaohua")
content=replace(request.form("content"),"'","")
repcontent="暂无回复"
ip=request.ServerVariables("REMOTE_ADDR")
verifycode=trim(request.form("verifycode"))

if name="" then
  response.write "<SCRIPT language=JavaScript>alert('用户昵称不能为空 或 输入字符非法！');"
  response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
  response.end
end if
if title="" then
  response.write "<SCRIPT language=JavaScript>alert('留言标题不能为空 或 输入字符非法！');"
  response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
  response.end
end if
if verifycode="" then
  response.write "<SCRIPT language=JavaScript>alert('请输入验证码！');"
  response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
  response.end
end if
if cstr(verifycode)<>cstr(Session("getcode")) then
response.write "<SCRIPT language=JavaScript>alert('您输入的验证码和系统产生的不一致！');"
response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
response.end
end if

if content="" then
  response.write "<SCRIPT language=JavaScript>alert('留言内容不能为空！');"
  response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
  response.end
end if

'过滤垃圾广告
call objad(content)

If len(content)>500 Then
response.write "<SCRIPT language=JavaScript>alert('留言内容超出500字！');"
response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
response.end
End If
If email<>"" and IsValidEmail(email)=false Then
response.write "<SCRIPT language=JavaScript>alert('请填写正确的邮箱地址！');"
response.write "this.location.href='vbscript:history.back()';</SCRIPT>"
response.end
End If

sql="insert into gb(name,sex,qq,email,homepage,title,content,qiaoqiaohua,repcontent,ip) values('"+name+"','"+sex+"','"+qq+"','"+email+"','"+homepage+"','"+title+"','"+content+"','"+qiaoqiaohua+"','"+repcontent+"','"+ip+"')"
conn.execute(sql)










只是用replace函数把单引号过虑成双引号，那我们提交“<script>alert("")</script>”会完整的返回来，如图二。直接查看源文件搜索IST，原来我们提交的被〈和“号闭合了，图三。那我们提交"><script>alert("IST")</script>  
<"号，OK，跨站成功。图四。这扁文章我也不投稿，所以就没有那么多废话了。