BBSxp 2008 (Build: 8.0.4) Sql Injection Vulnerability

MoveThread.asp MoveThread.asp行2-24 % if CookieUserName =empty then error"您还未a href=""javascript:BBSXPModal.Open 'Login.asp',380,170;""登录/a论坛" '保存cookie登陆即可 ThreadID=Request"ThreadID" ' Sql Injection Vulnerability If Not IsNumericThreadID then ThreadIDArray=SplitThreadID,"," '判断数组,避免13行出错 if...

BBSXP论坛程序Members.asp页面过滤不严导致SQL注入漏洞

漏洞文件： Members.asp 代码分析：. CurrentAccountStatus=HTMLEncodeRequest"CurrentAccountStatus" //第11行 。。。。。。 if CurrentAccountStatus "" then item=item&" and UserAccountStatus="&CurrentAccountStatus&"" //第22行 。。。。。。 TotalCount=Execute"Select countUserID From "&TablePrefix&"Users"&item0 //第54行...

BBSXP论坛程序New.asp页面过滤不严导致SQL注入漏洞

New.asp 代码分析： Sort=HTMLEncodeRequest"Sort" //第24行 if Sort = empty then SqlSort="ThreadID" else SqlSort=Sort end if 。。。。。。 sql="Select top "&SqlTopicCount&" from "&TablePrefix&"Threads where Visible=1 "&SqlForumID&" "&SqlTimeLimit&" order by "&SqlSort&" desc" //第66行 过滤函数HTMLEncode...

Various sites program's default database-vulnerability warning-the black bar safety net

Action Network: The default database /data/dvbbs7. mdb BACKUP DATABASE /databackup/dvbbs7. mdb Front: Username: admin Key code: admin888 Background: Username: admin Key code: admin888 --------------- bbsxp: The default database database/bbsxp. mdb ＿＿＿＿＿＿＿＿＿＿＿＿＿＿＿ LeadBBS The default database...

BBSXP 论坛程序存在文件上传漏洞

文件保存类型是通过FileMIME判断FileMIME="image/pjpeg" 也就是说上传类型要是图片 然后第一段代码 if FileExt="asa" or FileExt="asp" or FileExt="cdx" or FileExt="cer" then error2"对不起，管理员设定本论坛不允许上传 "&FileExt&" 格式的文件" 的意思是：出错时候检查后缀.如果后缀是asa或者asp或者cdx或者cer的时候他就会提示错误。然后FileExt=文件后缀...

The big data library default address-vulnerability warning-the black bar safety net

/data/dvbbs7. mdb Action Network Forum database /databackup/dvbbs7. mdb Action Network Forum database /bbs/databackup/dvbbs7. mdb Action Network Forum database /admin/data/qcdnnews. mdb green to create article management system database /data/qcdnnews. mdb green to create article management syste...

Then the storm BBSxp 7.0 Beta 2 vulnerability-vulnerability warning-the black bar safety net

The vulnerability exists in the file setup. asp The first part of the Registration－login-post-edit-capture-package-promoted to administrator-change background-password - login backend-WEBSHELL Here I set the password as: ttfct1 ,NC submitted successfully provided for the administrator. With...