eWebEditor v3.8 列目录

2015-08-12 16:01:48来源:作者:人点击

   标题:asp eWebEditor v3.8 列目录漏洞(其他版本为测试)

  漏洞文件:asp/browse.asp

  漏洞产生:

 Sub InitParam()

        sType = UCase(Trim(Request.QueryString("type")))        sStyleName = Trim(Request.QueryString("style"))        sCusDir = Trim(Request.QueryString("cusdir"))        Dim i, aStyleConfig, bValidStyle        bValidStyle = False        For i = 1 To Ubound(aStyle)                aStyleConfig = Split(aStyle(i), "|||")                If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then                        bValidStyle = True                        Exit For                End If        Next        If bValidStyle = False Then                OutScript("alert('Invalid Style.')")        End If        sBaseUrl = aStyleConfig(19)        nAllowBrowse = CLng(aStyleConfig(43))        nCusDirFlag = Clng(aStyleConfig(61))        If nAllowBrowse <> 1 Then                OutScript("alert('Do not allow browse!')")        End If        If nCusDirFlag <> 1 Then                sCusDir = ""        Else                sCusDir = Replace(sCusDir, "", "/")                If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then                        sCusDir = ""                Else                        If Right(sCusDir, 1) <> "/" Then                                sCusDir = sCusDir & "/"                        End If                End If        End If        sUploadDir = aStyleConfig(3)        If Left(sUploadDir, 1) <> "/" Then                sUploadDir = "../" & sUploadDir        End If        Select Case sBaseUrl        Case "0"                sContentPath = aStyleConfig(23)        Case "1"                sContentPath = RelativePath2RootPath(sUploadDir)        Case "2"                sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir))        End Select    sUploadDir = sUploadDir & sCusDir        sContentPath = sContentPath & sCusDir        Select Case sType        Case "FILE"                sAllowExt = ""        Case "MEDIA"                sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov"        Case "FLASH"                sAllowExt = "swf"        Case Else                sAllowExt = "bmp|jpg|jpeg|png|gif"        End Select        sCurrDir = sUploadDir        sDir = Trim(Request("dir"))'1.假设dir= ../'2.假设dir=...//'3.假设dir=.....///        sDir = Replace(sDir, "", "/")  '过滤1        sDir = Replace(sDir, "../", "") '过滤2'1.到这里就被过滤了        sDir = Replace(sDir, "./", "") '过滤3'2到这里也被功率了'3到这里就成../了。比较有趣的饶过!好象不少cms这样过滤过。[/color]        If sDir <> "" Then                If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then                        sCurrDir = sUploadDir & sDir & "/"                Else                        sDir = ""                End If        End IfEnd Sub

最新文章

123

最新摄影

微信扫一扫

第七城市微信公众平台