中华网络安全联盟    作者：佚名    来源：互联网    时间：2006-12-11 14:56:37

他的注入漏洞在马骏的blog 上发过 一个是 在：user目录下的soft.asp 和 ShowInfo.asp 都有注入漏洞！我今天发现的注入漏洞 也是在user目录下的 RegPost.asp 文件出现的漏洞！这个是注册的页面！

下面是code：

dim rs,sql,MyUserInfo
‘定义一些变量

dim UserName,UserPassWord,UserSex,UserQuestion,UserAnswer,UserEmail,HomePage,Address,TrueName,UserClass,UserQQ,UserMSN
dim TruePassWord,titlepic,UserGroupID
UserName = LZ8.Checkstr(request.form("UserName")) //LZ8.Checkstr过滤了
UserPassWord = trim(request.form("UserPassWord")) //一样过滤了！
UserSex = request.form("UserSex") // 这个呢！什么没有过滤啊？
UserQuestion = LZ8.Checkstr(request.form("UserQuestion"))
UserAnswer = LZ8.Checkstr(trim(request.form("UserAnswer")))
’下面的都没有过滤！

UserEmail = request.form("UserEmail")
HomePage = request.form("HomePage")
Address = request.form("Address")
TrueName = request.form("TrueName")
UserQQ = request.form("QQ")
UserMSN = request.form("MSN")

Call main()

Sub main()
Call Show_Reg_Info()
Call UserReg()
‘进了SQL 数据库
Set rs = LZ8.Execute("Select Id,yn,UserGroupID,UserName,TruePassWord,UserEmail,TrueName,UserSex,LastLogin,UserLogins,JoinDate,UserBirthday,UserLastIP,UserMoney,UserMsg From ["& UserTable &"] Where UserName = '"& UserName &"'")
If Not(rs.eof and rs.bof) Then
MyUserInfo=rs.GetString(,1, "|||", "", "")
End If

下面是检查用户名的：

Function UserReg()
sql = "Select * From ["& UserTable &"]"
Set rs = Server.CreateObject("adodb.recordset")
Connect:rs.open sql,conn,1,3
rs.addnew
if LZ8.WebSetting(15) = 1 then
rs("yn") = 0
else
rs("yn") = 1
end if
rs("UserName") = UserName
rs("UserPassWord") = md5(UserPassWord,16)
rs("UserSex") = UserSex
rs("UserQuestion") = UserQuestion
rs("UserAnswer") = md5(UserAnswer,16)
rs("UserEmail") = UserEmail
rs("UserHomePage") = HomePage
rs("Address") = Address
rs("TrueName") = TrueName
rs("JoinDate")=NOW()
rs("UserLogins")=1
rs("LastLogin")=NOW()
rs("UserLastIP")=Request.ServerVariables("REMOTE_ADDR")
rs("TruePassWord") = LZ8.Createpass()
rs.update
LZ8.DelObjCache("LeadWitLableLZ8User0")
End Function

Rem 检查此用户名是否含有禁注册字符
Function ChkRegName(str)
dim JoinStr,i
JoinStr = Split(LZ8.BadWords,"|||")(1)
JoinStr = Replace(JoinStr, CHR(10) , "")
JoinStr = Replace(JoinStr, CHR(13) , "")
If JoinStr = "" Or IsNull(JoinStr)then
ChkRegName = True
Exit Function
end if
If Instr("|"& JoinStr &"|","|"& Trim(str) &"|") > 0 then
ChkRegName = False
else
ChkRegName = True
end if
End Function
%>

漏洞我没有测试过了！只看了代码！

文章在文章内容加入跨站代码就可以了