威博多用户商城系统注入0day

                                                信息来源：安全警戒线 （www.hackeroo.com）
作    者：攻击者  


介绍：
威博多用户商城系统功能强大、可扩展性强：以ASP为主要的开发语言、结合新技术AJAX，全站生成静态HTML页面，系统运行速度和页面生成速度快。但其cart文件夹下的mycart.asp没有过滤好，从而存在SQL注入漏洞

漏洞文件代码：

Copy code
<%@ LANGUAGE ="VBScript.Encode" CodePage="936"%>
<!--#include file="include.asp"-->
<%
response.charset="gb2312"
action=request("action")
select case action
    case "add":
        call addshop()        'add an shopping
    case "del":
        call delshop()        'del an shopping
    case "e_mount": 
        call e_mount()        'modify shop count
end select
sub addshop()
    conndb
    if session("cartid")="" then
        session("cartid")=createonlyid
    end if
    usersocre=getonevalue("web_user","u_score","u_username='"&request.cookies("kkuid")&"'")
    other=request("other")
    w_zh=trim(request("w_zh"))
    pid=request.QueryString("pid")
    other=replace(other,"@@","",1,1)

    strwhere_2=" and c_sxid='"&w_zh&"'"
    strwhere="c_goodsid=" & pid & " and c_cartid='"&session("cartid")&"'"&strwhere_2
    tmpexist=ClassExist(id,"web_cart","c_goodsid",strwhere)
    c_goodcount=getonevalue("web_cart","c_goodscount",strwhere)
    if not isnumeric(c_goodcount) then c_goodcount=0 

    if isnull(w_zh) or trim(w_zh)="" then
        sql="select p_stock-p_solded as tmpnum from web_product where id=" & pid
        set ret=conn.execute(sql)
        if (ret("tmpnum")-c_goodcount)<=0 then 
            set ret=nothing
            response.write "<script>alert('商品库存不足');location.href='cart.asp'</script>"
            response.end
        end if
        ret.close : set ret=nothing
    else
        call w_check_zhstock(pid,w_zh,c_goodcount)
    end if

    if tmpexist=0 then    '商品已存在购物车，则修改数量
        sql="update web_cart set c_goodscount=c_goodscount+1,c_other='"&other&"' where c_goodsid=" & pid & " and c_cartid='"&session("cartid")&"'"&strwhere_2
          conn.execute(sql)
        closedb
    else            '插入一条记录在购物车表
        set rs=server.createobject("adodb.recordset")
        fldname="id,p_pid,p_name,p_marketprice,p_memberprice,p_weight,p_score,p_fee,shopid,p_classid,p_truegood,P_SetMyPrice,p_varprice,p_proclass,p_adminstate"    
        sql="select "&fldname&" from web_product where id=" & request("pid")
        rs.open sql,conn,3,1
        if rs("p_adminstate")=1 then
            closers
            response.write "<script>alert('该商品已被封停，无法购买');location.href='cart.asp'</script>"
            response.end            
        end if
            id=rs("id")
            name=rs("p_name")
            price1=rs("p_marketprice")
            if getonevalue("web_product","p_changsale","id="&pid&"")=1 then  '换购商品
                price2=rs("p_memberprice")
            else
                if request.cookies("kkuid")="" then
                    if trim(w_zh)="" or isnull(w_zh)=true then
                        price2=rs("p_memberprice")
                    else
                        price2=web_get_zhprice(rs("p_memberprice"),rs("P_SetMyPrice"),w_zh,rs("p_varprice"))
                    end if
                else
                    if trim(w_zh)="" or isnull(w_zh)=true then
                        w_zhprice=false
                    else
                        price2=web_get_zhprice_mem(rs("p_memberprice"),rs("P_SetMyPrice"),w_zh,rs("p_varprice"),trim(rs("shopid")))
                        w_zhprice=true
                    end if 
    
                    if w_zhprice=false then
                        price2=web_get_memprice_2(rs("p_memberprice"),rs("P_SetMyPrice"),trim(rs("shopid")))                    
                    end if
                end if
            end if
        
            
            'price3=rs("p_price3")
            actid=0
            weight=rs("p_weight")
            if request.cookies("kkuid")="" then
                score=rs("p_score")
            else
                score=rs("p_score")
            end if
            fee=rs("p_fee")
            shopid=rs("shopid")
            p_classid=rs("p_classid")
            p_pid=rs("p_pid")
            p_classid2=rs("p_proclass")
            p_truegood=rs("p_truegood")
            'p_truegood=rs("p_truegood")
        rs.close
        sql="select * from web_cart"
        rs.open sql,conn,2,2
        rs.addnew
            rs("c_cartid")=session("cartid")
            rs("c_userid")=request.cookies("kkuid")
            rs("c_goodsid")=id
            rs("c_pid")=p_pid
            rs("c_goodsname")=name
            rs("c_price")=price1
            rs("c_preprice")=price2
            rs("c_fee")=fee
            rs("c_goodscount")=1
            rs("c_activeid")=actid
            rs("c_weight")=weight
            rs("c_remarks")=score
            rs("c_other")=other
            rs("c_adddate")=now()
            rs("c_classid")=p_classid
            rs("shopid")=shopid
            rs("c_truegood")=p_truegood
            rs("c_sxid")=w_zh
            rs("c_mallclassid")=p_classid2
        rs.update
        rs.close : set rs=nothing
    end if
    response.redirect "cart.asp"
end sub
sub delshop()
    conndb
    c_goodsid=request("c_goodsid")
    c_zhid=request("c_zhid")
    if c_goodsid="all"  then
        sql="delete from web_cart where c_cartid='"&session("cartid")&"' "
    else
        sql="delete from web_cart where c_cartid='"&session("cartid")&"' and c_goodsid=" & c_goodsid&" and c_sxid='"&trim(c_zhid)&"'"
    end if
    conn.execute(sql)
    closedb
    response.redirect "cart.asp"
end sub
sub e_mount()
    dim count,goodsid,i
    conndb
          for i=1 to request.form("goodsid").count
            c_goodsid=replace(request.form("goodsid")(i),"'","")
            c_goodscount=replace(request.form("count")(i),"'","")
            c_zhid=replace(request.form("zhid")(i),"'","")
            if c_goodscount="" or isnumeric(c_goodscount)=false then
                call Web_C_ReMessage("数量不能为空且必须为整数",3,"")
            end if
            w_where=" and c_sxid='"&c_zhid&"'"

            if isnull(w_zh) or trim(w_zh)="" then
                sql="select p_stock-p_solded as tmpnum from web_product where id=" & c_goodsid
                set ret=conn.execute(sql)
                if ret("tmpnum")-c_goodscount<0 then 
                    set ret=nothing
                    response.write "<script>alert('商品库存不足');location.href='cart.asp'</script>"
                    response.end
                end if
                set ret=nothing
            else
                call w_check_zhstock(pid,w_zh,w_cartcount)
            end if

            if cint(c_goodscount)<=0 then
                sql="delete from web_cart where c_goodsid=" & c_goodsid & " and c_cartid='"&session("cartid")&"'"&w_where
            else
                sql="update [web_cart] set c_goodscount=" & c_goodscount & " where c_goodsid=" & c_goodsid & " and c_cartid='"&session("cartid")&"'"&w_where
            end if
            conn.execute(sql)

            'wholesaleid=getonevalue("web_product","p_wholesale","id="&c_goodsid&"")
            wholesaleid=0
            if wholesaleid<>0  then'如果存在批发放案 则进行价格更改
                if request.cookies("kkuid")="" then
                    userid=0
                else
                    userid=request.cookies("kkuid")
                end if

                if Returnpronum(wholesaleid,userid,c_goodscount)=1 then    '判断购物车中的数量是否达到了批发方案中的数量
                    discountprice=Returndiscount(wholesaleid,userid,c_goodscount)    
                    'response.write discountprice
                    'response.end            
                    if discountprice<100 then '如果有效折扣存在 则更改购物车中会员价格
                        memprice=getonevalue("web_product","P_MemberPrice","id="&c_goodsid&" ")*discountprice/100
                        sql="update web_cart set C_preprice="&memprice&" where C_goodsid="&c_goodsid&""
                        conn.execute(sql)
                    else
                        
                    end if
                else
                        if request.cookies("kkuid")="" then
                            memprice=getonevalue("web_product","P_MemberPrice","id="&c_goodsid&" ")
                        else
                            usersocre=getonevalue("web_user","u_score","u_username='"&request.cookies("kkuid")&"'")
                            P_SetMyPrice=getonevalue("web_product","P_SetMyPrice","id="&c_goodsid&"")
                            p_memberprice=getonevalue("web_product","p_memberprice","id="&c_goodsid&"")
                            if P_SetMyPrice="" or isnull(P_SetMyPrice)=true then
                                memprice=p_memberprice*GetUserClassDisrate(usersocre)
                            else
                                memprice=GetUserClassprice(usersocre,P_SetMyPrice)
                            end if
                        end if
                            sql="update web_cart set C_preprice="&memprice&" where C_goodsid="&c_goodsid&""
                            
                            conn.execute(sql)
                
                end if
        
            end if
        next
    '如果购物车中商品总价格小于换购商品订单价格 则删除购物车中换购商品 待扩展
    'if countcartmoney(session("cartid"))<getcartordermoney(session("cartid")) then 
    '    web_proid=getcartchanageproid(session("cartid"))
    '    conn.execute("delete from web_cart  where c_goodsid=" & web_proid & "")
    'end if
    closedb
    response.redirect "cart.asp"
end sub

Sub WriteErrMsg(errmsg)
    Response.Write "<script language='javascript'>alert('" & errmsg & "');history.go(-1);</script>"
    response.end 
End Sub

Function web_get_zhprice(w_memprice,w_myprice,w_zh,w_varprice)
    if isnull(w_varprice)=true or trim(w_varprice)="" then
        web_get_zhprice= w_memprice
        exit function
    end if 

    p_varprice_1=split(w_varprice,"**")
    for i=0 to ubound(p_varprice_1)
        p_sid=split(split(p_varprice_1(i),"~")(1),"|")
        'response.write w_zh&" "&p_sid(0)& " " & p_sid(1)&"<br>"
        if cstr(trim(w_zh))=cstr(trim(p_sid(0))) then
            if p_sid(1)="" then
                web_get_zhprice=w_memprice
            else
                web_get_zhprice=p_sid(1)
            end if 
            w_exist=true
            exit function
        end if 
        
    next
    if w_exist<>true then
        web_get_zhprice=w_memprice
    end if
    '1~7,10,13|1|@3,2@1,3@6,4@33,5@34,6**0~7,9,13|11|@3,22@1,33@6,44@33,55@34,66
End Function

Function w_check_zhstock(pid,byval w_zhstock,w_cartcount)
    w_nowstock=trim(getonevalue("web_product","p_zhstock","id="&pid))
    if isnull(w_nowstock)=true or w_nowstock="" then
        //未设置当前组合库存，不做判断
        exit function
    end if 
    p_stock=split(w_nowstock,"**")
    for i=0 to ubound(p_stock)
        p_stockcount=split(p_stock(i),"|")
        if cstr(trim(w_zhstock))=cstr(trim(p_stockcount(0))) then
            if clng(p_stockcount(1))-clng(w_cartcount)<=0 then
                response.write "<script>alert('该组合型号商品库存不足');location.href='cart.asp'</script>"
                response.end
            end if 
        end if
    next
End Function
%>