新云2.1&3.0的两个跨站

漏洞文件
1:user/changeinfo.asp







================省略部分代码==============================================
<%
End If
Rs.Close:Set Rs = Nothing
End If
If Founderr = True Then
Call Returnerr(ErrMsg)
End If
Sub ChangeUserInfo()
On Error Resume Next
Dim username, password,userid
Dim usersex,sex
username = Newasp.CheckBadstr(Newasp.membername)
userid = Newasp.ChkNumeric(memberid)
If Newasp.CheckPost=False Then
ErrMsg = ErrMsg + Postmsg
FoundErr = True
Exit Sub
End If
If Newasp.IsValidPassword(Request.Form("answer")) = False And Trim(Request.Form("answer")) <> "" Then
ErrMsg = ErrMsg + "<li>密码问题答案中含有非法字符！</li>"
Founderr = True
End If
If Trim(Request.Form("username")) <> username Then
ErrMsg = ErrMsg + "<li>非法操作！</li>"
Founderr = True
End If
If Trim(Request.Form("password")) = "" Then
ErrMsg = ErrMsg + "<li>请输入用户密码！</li>"
Founderr = True
Else
password = md5(Request.Form("password"))
End If
If userid = 0 Then
FoundErr = True
ErrMsg = ErrMsg + "<li>Sorry！您选择了错误的系统参数。</li>"
Exit Sub
End If

If Trim(Request.Form("nickname")) = "" Then
ErrMsg = ErrMsg + "<li>用户昵称不能为空！</li>"
Founderr = True
End If
If Newasp.IsValidStr(Request.Form("nickname")) = False Then
ErrMsg = ErrMsg + "<li>用户昵称中含有非法字符！</li>"
Founderr = True
End If
If Trim(Request.Form("TrueName")) = "" Then
ErrMsg = ErrMsg + "<li>真实姓名不能为空！</li>"
Founderr = True
End If
If Newasp.IsValidStr(Request.Form("TrueName")) = False Then
ErrMsg = ErrMsg + "<li>真实姓名中含有非法字符！</li>"
Founderr = True
End If
If Trim(Request.Form("usermail")) = "" Then
ErrMsg = ErrMsg + "<li>您的Email不能为空！</li>"
Founderr = True
End If
If IsValidEmail(Request.Form("usermail")) = False Then
ErrMsg = ErrMsg + "<li>您的Email有错误！</li>"
Founderr = True
End If
If Not IsNumeric(Request.Form("oicq")) And Trim(Request.Form("oicq")) <> "" Then
FoundErr = True
ErrMsg = ErrMsg + "<li>QQ号码请用数字填写。</li>"
End If
If Trim(Request.Form("HomePage")) <> "" And Left(Request.Form("HomePage"),7) <> "http://" Then
FoundErr = True
ErrMsg = ErrMsg + "<li>个人主页地址输入有误，请以“http://”开头。</li>"
End If
If Not Newasp.CodeIsTrue() Then
ErrMsg = ErrMsg + "<meta http-equiv=""refresh"" content=""2;URL=changeinfo.asp""><li>验证码校验失败，请返回刷新页面再试。两秒后自动返回</li>"
Session("GetCode") = ""
Founderr = True
Exit Sub
End If
Session("GetCode") = ""
If Trim(Request.Form("usersex")) = "" Then
ErrMsg = ErrMsg + "<li>您的姓别不能为空！</li>"
Founderr = True
Else
usersex = Newasp.CheckBadstr(Request.Form("usersex"))
End If
If usersex = "女" Then
sex = 0
Else
sex = 1
End If

If Founderr = True Then Exit Sub
Set Rs = Server.CreateObject("ADODB.RecordSet")
SQL = "Select * FROM [NC_user] Where username='" & username & "' And user>

方便多了不过这个paymode貌似只限制提交70个字符不过也够我们调用JS之类的,貌似盗了COOKIE可以直接欺骗后台吧? 呵呵官方的后台

原来是newasp_admin 后来喊他改了 HOHO 漏洞也补了

没什么技术含量纯属娱乐别见笑哈.