whmcs主机管理系统0day

发现BaigoCMS与用户注册流程中的安全漏洞

最新推荐文章于 2023-09-17 10:08:56 发布

转载最新推荐文章于 2023-09-17 10:08:56 发布 · 356 阅读

文章标签：

#user #session #qq #iis #脚本

本文深入探讨了BaigoCMS系统中关于用户注册页面的潜在安全问题，包括注册表单中对特殊字符的过滤不足，以及利用IIS6.0解析漏洞进行的恶意注册操作。此外，文章还揭示了该系统中存在的XSS攻击风险，以及用户上传头像时可能引发的安全隐患。

转载：天天向上网 http://www.52harry.com/network/2011-12-13/826.html

版权声明：转载时请以超链接形式标明文章原始出处和作者信息及本声明
 http://slhack.blogbus.com/logs/180963618.html

############################################################################
#
# Title: baigo bbs&baigo cms

# Time：2011-12-11

# Team:t00ls

# Author: darkdu0
############################################################################

user_reg.asp
'注册
case "user_reg_do"

        user_name = trim(request.form("user_name"))
        user_pass = trim(request.form("user_pass"))
        user_pass_again = trim(request.form("user_pass_again"))
        user_mail = trim(request.form("user_mail"))
        user_pass_question = trim(request.form("user_pass_question"))
        user_pass_answer = trim(request.form("user_pass_answer"))
        user_sex = trim(request.form("user_sex"))
        user_www = trim(request.form("user_www"))
        user_sign = trim(request.form("user_sign"))
        user_face = trim(request.form("user_face"))
        user_qq = trim(request.form("user_qq"))
        user_msn = trim(request.form("user_msn"))
        %>
简单过滤空格
        if instr(user_name,"        ") > 0 or instr(user_name,"#") > 0 or instr(user_name,"`") > 0 or instr(user_name,"|") > 0 or instr(user_name," ") > 0 or instr(user_name,"　") > 0 or Instr(user_name,"%") > 0 or Instr(user_name,"&") > 0 or Instr(user_name,"ヴ") > 0 or Instr(user_name,"ヂ") > 0 or Instr(user_name,"ゼ") > 0 or Instr(user_name,"ヅ") > 0 or Instr(user_name,"") > 0 or Instr(user_name,"+") > 0 or Instr(user_name,"=") > 0 or Instr(user_name,"'") > 0 then
        session("message") = "
用户名中不能含有特殊符号 "