### 简要描述： 某通用在线考试系统可getshell、注册管理员等 ### 详细说明： 上海天柏信息科技有限公司的系统： 测试地址：http://www.timber2005.com/Product_sy.html demo： http://exam1.timber2005.com/login.aspx 首先注册一个普通账号： [<img src="https://images.seebug.org/upload/201409/14162138d5881133c4e95f98b25650a20c465267.jpg" alt="21.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162138d5881133c4e95f98b25650a20c465267.jpg) 然后登陆： [<img src="https://images.seebug.org/upload/201409/141622482d992d1840ffba7a4a48fb7ceb3c3a7e.jpg" alt="22.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141622482d992d1840ffba7a4a48fb7ceb3c3a7e.jpg) 之后直接访问： http://exam1.timber2005.com/system/system_config.aspx [<img src="https://images.seebug.org/upload/201409/141625110d99a02f23a89571cb9a60efd021a5db.jpg" alt="23.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141625110d99a02f23a89571cb9a60efd021a5db.jpg)...
### 简要描述： 某通用在线考试系统可getshell、注册管理员等 ### 详细说明： 上海天柏信息科技有限公司的系统： 测试地址：http://www.timber2005.com/Product_sy.html demo： http://exam1.timber2005.com/login.aspx 首先注册一个普通账号： [<img src="https://images.seebug.org/upload/201409/14162138d5881133c4e95f98b25650a20c465267.jpg" alt="21.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162138d5881133c4e95f98b25650a20c465267.jpg) 然后登陆： [<img src="https://images.seebug.org/upload/201409/141622482d992d1840ffba7a4a48fb7ceb3c3a7e.jpg" alt="22.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141622482d992d1840ffba7a4a48fb7ceb3c3a7e.jpg) 之后直接访问： http://exam1.timber2005.com/system/system_config.aspx [<img src="https://images.seebug.org/upload/201409/141625110d99a02f23a89571cb9a60efd021a5db.jpg" alt="23.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141625110d99a02f23a89571cb9a60efd021a5db.jpg) -======================================================= 这里有两个问题： 1.修改注册，直接注册管理员： [<img src="https://images.seebug.org/upload/201409/141626289a5e652121ca949c724e9b8346bd074d.jpg" alt="24.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141626289a5e652121ca949c724e9b8346bd074d.jpg) 然后去注册，直接就是管理员： [<img src="https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg" alt="25.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg) ===================================================== 第二个问题，可以上传任意文件： 抓包，修改文件名,即可上传成功： [<img src="https://images.seebug.org/upload/201409/14163337489d62ec352f68b85599b6ae9bc4d6b0.jpg" alt="26.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14163337489d62ec352f68b85599b6ae9bc4d6b0.jpg) 这里服务器限制了目录执行权限： [<img src="https://images.seebug.org/upload/201409/14163539b7f0adb9a13ec0d45c8eee68964fe857.jpg" alt="27.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14163539b7f0adb9a13ec0d45c8eee68964fe857.jpg) 我们找一个同一个系统没有限制的： [<img src="https://images.seebug.org/upload/201409/141641597eb70053670ab971bbc0488fefcfb016.jpg" alt="28.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141641597eb70053670ab971bbc0488fefcfb016.jpg) http://zx.gzzkzsw.com/UpLoad/System/20140914164100746093.aspx [<img src="https://images.seebug.org/upload/201409/141642145d1de16378a13e73b24107e4673f3ad2.jpg" alt="29.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141642145d1de16378a13e73b24107e4673f3ad2.jpg) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg" alt="25.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg) http://exam1.timber2005.com/UpLoad/System/picture/20140914163514890625.txt http://zx.gzzkzsw.com/UpLoad/System/20140914164100746093.aspx
