Description
BUGTRAQ ID: 29429
DVBBS是一款Aspsky.Net开发和维护的开放源码ASP Web论坛程序。
DvBBS的login.asp页面没有正确地验证用户所提交的登录请求，远程攻击者可以通过提交恶意的登录请求执行SQL注入攻击，判断有效的用户名和密码HASH。
Dvbbs 8.2
动网论坛
--------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
<a href=http://www.dvbbs.net/ target=_blank>http://www.dvbbs.net/</a>
{"sourceData": "\n http:///www.example.com/?password=123123&amp;codestr=71&amp;CookieDate=2&amp;userhidden=2&amp;comeurl=index.asp&amp;submit=%u7ACB%u5373%u767B%u5F55&amp;ajaxPost=1&amp;username=where%2527%2520and%25201%253D%2528select%2520c\n ", "status": "poc,details", "description": "BUGTRAQ ID: 29429\r\n\r\nDVBBS\u662f\u4e00\u6b3eAspsky.Net\u5f00\u53d1\u548c\u7ef4\u62a4\u7684\u5f00\u653e\u6e90\u7801ASP Web\u8bba\u575b\u7a0b\u5e8f\u3002\r\n\r\nDvBBS\u7684login.asp\u9875\u9762\u6ca1\u6709\u6b63\u786e\u5730\u9a8c\u8bc1\u7528\u6237\u6240\u63d0\u4ea4\u7684\u767b\u5f55\u8bf7\u6c42\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u63d0\u4ea4\u6076\u610f\u7684\u767b\u5f55\u8bf7\u6c42\u6267\u884cSQL\u6ce8\u5165\u653b\u51fb\uff0c\u5224\u65ad\u6709\u6548\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801HASH\u3002\n\nDvbbs 8.2\n \u52a8\u7f51\u8bba\u575b\r\n--------\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=http://www.dvbbs.net/ target=_blank>http://www.dvbbs.net/</a>", "sourceHref": "https://www.seebug.org/vuldb/ssvid-3358", "reporter": "Root", "href": "https://www.seebug.org/vuldb/ssvid-3358", "type": "seebug", "viewCount": 3, "references": [], "lastseen": "2017-11-19T21:41:15", "published": "2008-06-01T00:00:00", "cvelist": [], "id": "SSV:3358", "enchantments_done": [], "modified": "2008-06-01T00:00:00", "title": "\u52a8\u7f51\u8bba\u575bDvBBS login.asp\u811a\u672c\u591a\u4e2aSQL\u6ce8\u5165\u6f0f\u6d1e", "cvss": {"score": 0.0, "vector": "NONE"}, "bulletinFamily": "exploit", "enchantments": {"score": {"value": -0.3, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.3}, "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645578890}}
{}
动网论坛DvBBS login.asp脚本多个SQL注入漏洞