描述:
漏洞文件tags.asp
变量tagid未经过滤传值，带入sql执行，导致注入产生。
再来啰嗦一下代码的问题tags.asp行15-36
sType = LCase(Trim(Request.Querystring(”t”)))
iTagId = Trim(Request.Querystring(”tagid”)) ’这个地方没过滤，在36行处传值给函数GetUsersByTag
iUserId = Trim(Request.Querystring(”userid”))
sKeyword= Trim(Request(”keyword”))
sAll=Trim(Request.Querystring)
If sAll & sKeyword=”\" Then sType=”hottags”
Call link_database()
select Case sType
Case ”hottags”
sTitle=”最热门的100个” & P_TAGS_DESC
sContent=Tags_Hottags()
Case ”cloud”
sTitle=P_TAGS_DESC & ”云图”
sContent=Tags_SystemTags(1)
Case ”list”
sTitle=P_TAGS_DESC & ”列表”
sContent=Tags_SystemTags(0)
Case ”user”
sTitle=P_TAGS_DESC & ”用户”
sContent=GetUsersByTag(iTagId)
函数GetUsersByTag的原型在文件Inc_Tags.asp行320-338
Function GetUsersByTag(byval sTagId)
Dim rst,sSql,sContent
Set rst = Server.CreateObject(”Adodb.Recordset”)
sSql = ”select Top 100 b.userName,b.user_dir,b.user_folder From (select Userid From oblog_usertags Where Tagid=” & sTagId & ” Group By UserId) a,oblog_user b Where a.Userid=b.UserId”
rst.Open sSql,conn,1,1
If rst.Eof Then
sContent=”没有符合条件的用户”
rst.Close
Set rst = Nothing
End If
i=0
Do While Not rst.Eof
sContent=sContent & ”” & rst(”userName”) & ”
”
rst.movenext
Loop
rst.Close
Set rst = Nothing
GetUsersByTag=sContent
End Function
|