bbsxp sql最新版0day

bbsxp前段时间出了个log的注入漏洞，这次的漏洞还是出现在这个地方。
sub Log(Message)
if Request.ServerVariables("Query_String")<>"" then Query_String="?"&Request.ServerVariables("Query_String")&""
Conn.Execute("insert into [BBSXP_Log] (UserName,IPAddress,UserAgent,HttpVerb,PathAndQuery,Referrer,ErrDescription,POSTData,Notes) values ('"&CookieUserName&"','"&Request.ServerVariables("REMOTE_ADDR")&"','"&HTMLEncode(Request.Servervariables("HTTP_User_AGENT"))&"','"&Request.ServerVariables("request_method")&"','http://"&Request.ServerVariables("server_name")&""&Request.ServerVariables("script_name")&""&Query_String&"','"&HTMLEncode(Request.ServerVariables("HTTP_REFERER"))&"','"&Err.Description&"','"&Request.Form&"','"&Message&"')")
end sub
上次漏洞就是出现在HTTP_REFERER上，最新版本的已经用HTMLEncode处理过了。其实在在这个log()里面还是有我们可以控制的变量,就是Request.Form
注册个用户yl6364,发个贴再编辑。抓包如下:
POST /bbsxp/editpost.asp?threadid=1&postid=1 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Referer: http://localhost/bbsxp/editpost.asp?threadid=1&postid=1
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)
Host: localhost
Content-Length: 53
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: skins=1; Eremite=0; UserID=2; Userpass=1679707407E0FEDAA79EA80AB389A964; Onlinetime=2007%2D3%2D10+21%3A30%3A37; ForumNameList=%3Coption%20value%3D%27ShowForum.asp%3FForumID%3D1%27%3E%u7F51%u7EDC%3C/option%3E; ASPSESSIONIDSQCDCSQA=NBOPHAJCAIEFFCMHGDFJNKBH; ASPSESSIONIDSCTRRACA=OCIBAKBAFDDDJAADKKJBPBNI

content=test+log&UpFileID=&Category=&Subject=test+log

[1] [2] 下一页