经代码审核发现blogcomm.asp、class/cls_wap.asp、member.asp存在SQL注入漏洞。 在member.asp文件 1. UID=trim(CheckStr(request.form("UID"))) //191行 2. …………………… 3. set checkUser=conn.execute("select top 1 * from blog_Member where mem_id="&UID" and mem_Name='"&CheckStr(memName)"'") 4. if checkUser.eof then 5. ReInfo(0)="错误信息" 6. ReInfo(1)="<b>不存在此用户<br/>操作失败！</b><br/><a href=""javascript:history.go(-1);"">单击返回</a>" 7. ReInfo(2)="ErrorIcon" 8. SaveMem=ReInfo 9. exit function 10. end if 11. …………………… 12. （214行） 下面给出CheckStr函数原形： Function CheckStr(byVal ChkStr) Dim Str:Str=ChkStr If IsNull(Str) Then CheckStr = "" Exit Function End If Str = Replace(Str, "&", "&") Str = Replace(Str,"'","'") Str = Replace(Str,"""",""") Dim re Set re=new RegExp re.IgnoreCase =True re.Global=True...
经代码审核发现blogcomm.asp、class/cls_wap.asp、member.asp存在SQL注入漏洞。 在member.asp文件 1. UID=trim(CheckStr(request.form("UID"))) //191行 2. …………………… 3. set checkUser=conn.execute("select top 1 * from blog_Member where mem_id="&UID" and mem_Name='"&CheckStr(memName)"'") 4. if checkUser.eof then 5. ReInfo(0)="错误信息" 6. ReInfo(1)="<b>不存在此用户<br/>操作失败！</b><br/><a href=""javascript:history.go(-1);"">单击返回</a>" 7. ReInfo(2)="ErrorIcon" 8. SaveMem=ReInfo 9. exit function 10. end if 11. …………………… 12. （214行） 下面给出CheckStr函数原形： Function CheckStr(byVal ChkStr) Dim Str:Str=ChkStr If IsNull(Str) Then CheckStr = "" Exit Function End If Str = Replace(Str, "&", "&") Str = Replace(Str,"'","'") Str = Replace(Str,"""",""") Dim re Set re=new RegExp re.IgnoreCase =True re.Global=True re.Pattern="(w)(here)" Str = re.replace(Str,"$1here") re.Pattern="(s)(elect)" Str = re.replace(Str,"$1elect") re.Pattern="(i)(nsert)" Str = re.replace(Str,"$1nsert") re.Pattern="(c)(reate)" Str = re.replace(Str,"$1reate") re.Pattern="(d)(rop)" Str = re.replace(Str,"$1rop") re.Pattern="(a)(lter)" Str = re.replace(Str,"$1lter") re.Pattern="(d)(elete)" Str = re.replace(Str,"$1elete") re.Pattern="(u)(pdate)" Str = re.replace(Str,"$1pdate") re.Pattern="(\s)(or)" Str = re.replace(Str,"$1or") Set re=Nothing CheckStr=Str End Function 可以看出，这个CheckStr函数过滤了',select,or等字符。 但是其中UID没有包含在单引号内，而且对blog_Member 表进行查询，从而导致注入。 PJBlog2 v2.7 Build 04 PJBlog ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=http://www.pjhome.net/ target=_blank rel=external nofollow>http://www.pjhome.net/</a>
