eWebEditor v3.8 列目录_ASP教程

2024-05-04 11:04:45

字体：大中小

来源：转载

供稿：网友

推荐：ASP无组件分页实现思路及代码
无组件分页不可思议吧，看一看本文的效果就知道了，下面与大家分享下具体的实现，感兴趣的朋友可以参考下哈

　　标题：asp eWebEditor v3.8 列目录漏洞(其他版本为测试)

　　漏洞文件：asp/browse.asp

　　漏洞产生：

　Sub InitParam()

sType = UCase(Trim(Request.QueryString("type"))) sStyleName = Trim(Request.QueryString("style")) sCusDir = Trim(Request.QueryString("cusdir")) Dim i, aStyleConfig, bValidStyle bValidStyle = False For i = 1 To Ubound(aStyle) aStyleConfig = Split(aStyle(i), "|||") If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then bValidStyle = True Exit For End If Next If bValidStyle = False Then OutScript("alert('Invalid Style.')") End If sBaseUrl = aStyleConfig(19) nAllowBrowse = CLng(aStyleConfig(43)) nCusDirFlag = Clng(aStyleConfig(61)) If nAllowBrowse <> 1 Then OutScript("alert('Do not allow browse!')") End If If nCusDirFlag <> 1 Then sCusDir = "" Else sCusDir = Replace(sCusDir, "/", "/") If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then sCusDir = "" Else If Right(sCusDir, 1) <> "/" Then sCusDir = sCusDir & "/" End If End If End If sUploadDir = aStyleConfig(3) If Left(sUploadDir, 1) <> "/" Then sUploadDir = "../" & sUploadDir End If Select Case sBaseUrl Case "0" sContentPath = aStyleConfig(23) Case "1" sContentPath = RelativePath2RootPath(sUploadDir) Case "2" sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir)) End Select sUploadDir = sUploadDir & sCusDir sContentPath = sContentPath & sCusDir Select Case sType Case "FILE" sAllowExt = "" Case "MEDIA" sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov" Case "FLASH" sAllowExt = "swf" Case Else sAllowExt = "bmp|jpg|jpeg|png|gif" End Select sCurrDir = sUploadDir sDir = Trim(Request("dir"))'1.假设dir= ../'2.假设dir=...//'3.假设dir=...../// sDir = Replace(sDir, "/", "/") '过滤1 sDir = Replace(sDir, "../", "") '过滤2'1.到这里就被过滤了 sDir = Replace(sDir, "./", "") '过滤3'2到这里也被功率了'3到这里就成../了。比较有趣的饶过！好象不少cms这样过滤过。[/color] If sDir <> "" Then If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then sCurrDir = sUploadDir & sDir & "/" Else sDir = "" End If End IfEnd Sub

分享：ASP如何获取真实IP地址
在 ASP 中使用 Request.ServerVariables(REMOTE_ADDR) 来取得客户端的 IP 地址，但如果客户端是使用代理服务器来访问，那取到的就是代理服务器的 IP 地址，而不是真正的客户端 IP 地址。要想透过代理服务器取得客户端的真实IP 地址，就要使用Request.ServerVariables(H

上一篇：ASP无组件分页实现思路及代码_ASP教程

下一篇：asp中用for循环的一个小技巧_ASP教程

学习交流

硬盘分区如何设置准确的分区空间

硬盘分区如何设置准确的分区空间...

热门图片

猜你喜欢的新闻

猜你喜欢的关注