AspCms_v1.5_2011.03.03 多个0day漏洞及修复
akast [N.S.T] 一、 介绍 ASPCMS是由武汉上谷网络科技有限公司基于ASP+Access(sql2000)开发并完全开源的一套建站系统，主要面向企业进行快速的建造简洁，高效，易用，安全的公司企业网站，一般的开发人员就能够使用本系统以最低的成本、最少的人力投入在最短
akast [N.S.T]
一、 介绍
ASPCMS是由武汉上谷网络科技有限公司基于ASP+Access(sql2000)开发并完全开源的一套建站系统，主要面向企业进行快速的建造简洁，高效，易用，安全的公司企业网站，一般的开发人员就能够使用本系统以最低的成本、最少的人力投入在最短的时间内架设一个功能齐全、性能优异的公司企业网站。说的挺好啊，Google了一下还没有人发过它的高危漏洞，转来转去也就是一个XSS，不过还倒是不少网站使用着这套CMS
二、 默认缺陷
最大的缺陷莫过于默认的东西的，这个ASPCMS默认的管理员是admin，密码是123456，默认的access数据库是AspCms_datadata.asp，导致直接在网站前台“客户反馈”――“在线留言”里面就可以直接往数据库插入一句话的shell了。http://www.2cto.com/gbook/
直接插一句话，连接数据库拿http://www.2cto.com/AspCms_data/data.asp。
三、 框架钓鱼
B0mbErM@n发的AspCms v1.1元旦版XSS漏洞是在产品搜索的地方，这个地方除了欺骗管理员之外，还存在一种攻击方法就是使用iframe语句来进行框架调鱼，其实也就是XSS的一种利用方法而已了，如：
五、 后台拿webshell
在“风格模板管理”-“添加模板”的地方直接添加一个文件名称为asp或aspx后缀的文件，文件内容为webshell的代码即可。
还有就是使用FCK编辑器了，不过这个编辑器是要登录后台之后才能上传东西。地址如下：
http://www.2cto.com/fckeditor/editor/filemanager/browser/default/browser.html?Type=Image&Connector=%2Ffckeditor%2Feditor%2Ffilemanager%2Fconnectors%2Fasp%2Fconnector.asp
from：逍遥复仇
修复：程序是这个，问题都是老问题，不用一条条分析了，具体请参看本站文章
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1386
52
Explain InnoDB Full-Text Search capabilities.
Apr 02, 2025 pm 06:09 PM
InnoDB's full-text search capabilities are very powerful, which can significantly improve database query efficiency and ability to process large amounts of text data. 1) InnoDB implements full-text search through inverted indexing, supporting basic and advanced search queries. 2) Use MATCH and AGAINST keywords to search, support Boolean mode and phrase search. 3) Optimization methods include using word segmentation technology, periodic rebuilding of indexes and adjusting cache size to improve performance and accuracy.
How do you alter a table in MySQL using the ALTER TABLE statement?
Mar 19, 2025 pm 03:51 PM
The article discusses using MySQL's ALTER TABLE statement to modify tables, including adding/dropping columns, renaming tables/columns, and changing column data types.
When might a full table scan be faster than using an index in MySQL?
Apr 09, 2025 am 12:05 AM
Full table scanning may be faster in MySQL than using indexes. Specific cases include: 1) the data volume is small; 2) when the query returns a large amount of data; 3) when the index column is not highly selective; 4) when the complex query. By analyzing query plans, optimizing indexes, avoiding over-index and regularly maintaining tables, you can make the best choices in practical applications.
Can I install mysql on Windows 7
Apr 08, 2025 pm 03:21 PM
Yes, MySQL can be installed on Windows 7, and although Microsoft has stopped supporting Windows 7, MySQL is still compatible with it. However, the following points should be noted during the installation process: Download the MySQL installer for Windows. Select the appropriate version of MySQL (community or enterprise). Select the appropriate installation directory and character set during the installation process. Set the root user password and keep it properly. Connect to the database for testing. Note the compatibility and security issues on Windows 7, and it is recommended to upgrade to a supported operating system.
Difference between clustered index and non-clustered index (secondary index) in InnoDB.
Apr 02, 2025 pm 06:25 PM
The difference between clustered index and non-clustered index is: 1. Clustered index stores data rows in the index structure, which is suitable for querying by primary key and range. 2. The non-clustered index stores index key values and pointers to data rows, and is suitable for non-primary key column queries.
What are some popular MySQL GUI tools (e.g., MySQL Workbench, phpMyAdmin)?
Mar 21, 2025 pm 06:28 PM
Article discusses popular MySQL GUI tools like MySQL Workbench and phpMyAdmin, comparing their features and suitability for beginners and advanced users.[159 characters]
How do you handle large datasets in MySQL?
Mar 21, 2025 pm 12:15 PM
Article discusses strategies for handling large datasets in MySQL, including partitioning, sharding, indexing, and query optimization.
How do you drop a table in MySQL using the DROP TABLE statement?
Mar 19, 2025 pm 03:52 PM
The article discusses dropping tables in MySQL using the DROP TABLE statement, emphasizing precautions and risks. It highlights that the action is irreversible without backups, detailing recovery methods and potential production environment hazards.
