WooYun.org

Dim KS:Set KS=New PublicCls
Dim Action
Action=KS.S("Action")
Select Case Action
 Case "Ctoe" CtoE
 Case "GetTags" GetTags
 Case "GetRelativeItem" GetRelativeItem //问题函数
 ...skip...
 Case "getonlinelist" getonlinelist
End Select

Sub GetRelativeItem() //漏洞函数开始
    Dim Key:Key=UnEscape(KS.S("Key"))//漏洞位置，只调用ks.s函数，无其它过滤。
    Dim Rtitle:rtitle=lcase(KS.G("rtitle"))
    Dim RKey:Rkey=lcase(KS.G("Rkey"))
    Dim ChannelID:ChannelID=KS.ChkClng(KS.S("Channelid"))
    Dim ID:ID=KS.ChkClng(KS.G("ID"))
    Dim Param,RS,SQL,k,SqlStr
    If Key<>"" Then
      If (Rtitle="true" Or RKey="true") Then
       If Rtitle="true" Then
         param=Param & " title like '%" & key & "%'"//类似搜索型注入漏洞。
       end if
       If Rkey="true" Then
         If Param="" Then
           Param=Param & " keywords like '%" & key & "%'"
         Else
           Param=Param & " or keywords like '%" & key & "%'"
         End If
       End If
    Else
       Param=Param & " keywords like '%" & key & "%'"
    End If
   End If
   
    
    If Param<>"" Then 
        Param=" where InfoID<>" & id & " and (" & param & ")"
    else
       Param=" where InfoID<>" & id
    end if
    
     If ChannelID<>0 Then Param=Param & " and ChannelID=" & ChannelID
     
     Param=Param & " and verific=1"
   
    SqlStr="Select top 30 ChannelID,InfoID,Title From KS_ItemInfo " & Param & " order by id desc" //查询
    Set RS=Server.CreateObject("ADODB.RECORDSET")
    RS.Open SqlStr,conn,1,1
    If Not RS.Eof Then
     SQL=RS.GetRows(-1)
    End If
    RS.Close

Public Function S(Str)
    S = DelSql(Replace(Replace(Request(Str), "'", ""), """", ""))

Function DelSql(Str)
      Dim SplitSqlStr,SplitSqlArr,I
      SplitSqlStr="dbcc|alter|drop|*|and |exec|or |insert|select|delete|update|count |master|truncate|declare|char|mid|chr|set |where|xp_cmdshell"
      SplitSqlArr = Split(SplitSqlStr,"|")
      For I=LBound(SplitSqlArr) To Ubound(SplitSqlArr)
         If Instr(LCase(Str),SplitSqlArr(I))>0 Then
            Die "<script>alert('系统警告！\n\n1、您提交的数据有恶意字符" & SplitSqlArr(I) &";\n2、您的数据已经被记录;\n3、您的IP："&GetIP&";\n4、操作日期："&Now&";\n      Powered By Kesion.Com!');window.close();</script>"
         End if
      Next
      DelSql = Str
    End Function