[推荐]joekoe CMS 4.0 两个漏洞（上传漏洞+注入）乔客(joekoe) CMS 4.0 的2个高危漏洞
前段时间读了读乔客,发现在乔客4.0版本中存在两个高危漏洞,一个上传漏洞,可以随意上传任意文件,包括ASP,另一个是SQL注入,甚至还有返回错误信息,可怕啊
上传漏洞:
看\common\include\web.upload.asp 中的代码
| 以下是引用片段： sub doPageLoad() if APP_STATUS="close" then treeData.addItem "_status","error.message" treeData.addItem "_message","网站暂时因关闭维护中！请稍候..." exit sub end if up.doInit() if not upConfig.isInit then treeData.addItem "_status","error.message" treeData.addItem "_message","上传文件的参数不正确！" else doPageLoadUser() select case upConfig.channel case "forum" upConfig.setSaveDir(upConfig.getSaveDir&(left (ops.time.toConvertString("",10),6)&DIR_SEPARATOR)) upConfig.filename="" case "user.face" upConfig.filename="face_"&upConfig.userid upConfig.setSaveDir("face"&DIR_SEPARATOR) upConfig.filetype="gif" case "blog.logo" upConfig.setSaveDir("blog"&DIR_SEPARATOR) upConfig.filetype="gif" case else if instr(upConfig.channel,".")>0 then upConfig.setSaveDir(mid(upConfig.channel,1,instr (upConfig.channel,".")-1)&DIR_SEPARATOR) end if if instr(upConfig.fileinput,"url")>0 then upConfig.filetype="affix" end if end select if len(upConfig.getSaveDir())<3 then treeData.addItem "_status","error.message" treeData.addItem "_message","上传文件的参数不正确！" exit sub end if if 1=1 then upConfig.setData "zoom.channel.width",120 upConfig.setData "zoom.channel.height",90 end if upConfig.setBaseDir(DIR_ROOT&DIR_UPLOAD) upConfig.setBasePath(opsDirPath(DIR_ROOT&DIR_UPLOAD)) upConfig.setBaseURL(URL_UPLOAD) up.doLoad() end if end sub |
| 以下是引用片段： if up.isPost() then call doParseUploadData() treeData.addItem "_status","succeed" dim tmpFormMode,tmpFileValue,tmpThumbValue tmpFormMode="set" if upConfig.channel="user.face" then tmpLinkMode="no" tmpFileValue="#"&up.getFileInfo("filename") else tmpFileValue=up.getFileInfo("file.path") select case upConfig.filetype case "file" tmpLinkMode="no" 'tmpFileValue=up.getFileInfo("file.path") case "pic","spic","pics","affix","gif","jpg","jpeg","bmp","png" tmpLinkMode="no" tmpThumbValue=up.getFileInfo("thumb.path") case else tmpLinkMode="again" tmpFormMode="append" dim tmpFileType:tmpFileType=lcase(up.getFileInfo("filetype")) select case tmpFileType case "gif","jpg","jpeg","bmp","png" tmpFileValue="" case "swf" tmpFileValue="[flash=350,250]upload/"&up.getFileInfo ("file.path")&"[/flash]" case else tmpFileValue="[download="&tmpFileType&"]upload_download.asp? id="&upConfig.fileid&"[/download]" end select end select end if treeData.addItem "_form.mode",tmpFormMode treeData.addItem "_form.filevalue",tmpFileValue treeData.addItem "_form.thumbvalue",tmpThumbValue end if |
| joekoe CMS 4.0 两个漏洞（上传漏 | 07-26 | |
| XSS Phishing - 新式跨站脚本攻击 | 07-26 | |
| 浅析XSS(Cross Site Script)漏洞 | 07-26 | |
| BBSXP 2007的漏洞利用演示 | 07-11 | |
| 动网8.0最新漏洞 | 07-11 | |
| LBS blog又一注射漏洞含漏洞解析 | 07-04 | |
| BBSxp 2007 注射漏洞 | 07-02 | |
| 淘宝taobao 跨站 XSS 漏洞 | 06-29 | |
| LBS blog sql注射漏洞(统杀所有版 | 06-29 | |
| 最新QQ 163 126 等邮箱跨站挂马代 | 06-18 | |
| 入侵清华大学全过程 | 06-14 | |
| 入侵复旦大学 | 06-14 | |
您现在的位置：