Kesion cms注入漏洞分析及其修复方案

Dim KS:Set KS=New PublicCls Dim Action Action=KS.S(\”Action\”) Select Case Action Case \”Ctoe\” CtoE Case \”GetTags\” GetTags Case \”GetRelativeItem\” GetRelativeItem //问题函数 …skip… Case \”getonlinelist\” getonlinelist End Select Sub GetRelativeItem() //漏洞函数开始 Dim Key:Key=UnEscape(KS.S(\”Key\”))//漏洞位置，只调用ks.s函数，无其它过滤。 Dim Rtitle:rtitle=lcase(KS.G(\”rtitle\”)) Dim RKey:Rkey=lcase(KS.G(\”Rkey\”)) Dim ChannelID:ChannelID=KS.ChkClng(KS.S(\”Channelid\”)) Dim ID:ID=KS.ChkClng(KS.G(\”ID\”)) Dim Param,RS,SQL,k,SqlStr If Key<>\”\” Then If (Rtitle=\”true\” Or RKey=\”true\”) Then If Rtitle=\”true\” Then param=Param & \” title like \’%\” & key & \”%\’\”//类似搜索型注入漏洞。 end if If Rkey=\”true\” Then If Param=\”\” Then Param=Param & \” keywords like \’%\” & key & \”%\’\” Else Param=Param & \” or keywords like \’%\” & key & \”%\’\” End If End If Else Param=Param & \” keywords like \’%\” & key & \”%\’\” End If End If If Param<>\”\” Then Param=\” where InfoID<>\” & id & \” and (\” & param & \”)\” else Param=\” where InfoID<>\” & id end if If ChannelID<>0 Then Param=Param & \” and ChannelID=\” & ChannelID Param=Param & \” and verific=1\” SqlStr=\”Select top 30 ChannelID,InfoID,Title From KS_ItemInfo \” & Param & \” order by id desc\” //查询 Set RS=Server.CreateObject(\”ADODB.RECORDSET\”) RS.Open SqlStr,conn,1,1 If Not RS.Eof Then SQL=RS.GetRows(-1) End If RS.Close

Public Function S(Str) S = DelSql(Replace(Replace(Request(Str), \”\’\”, \”\”), \”\”\”\”, \”\”)) Function DelSql(Str) Dim SplitSqlStr,SplitSqlArr,I SplitSqlStr=\”dbcc|alter|drop|*|and |exec|or |insert|select|delete|update|count |master|truncate|declare|char|mid|chr|set |where|xp_cmdshell\” SplitSqlArr = Split(SplitSqlStr,\”|\”) For I=LBound(SplitSqlArr) To Ubound(SplitSqlArr) If Instr(LCase(Str),SplitSqlArr(I))>0 Then Die \”<script>alert(\’系统警告！\\n\\n1、您提交的数据有恶意字符\” & SplitSqlArr(I) &\”;\\n2、您的数据已经被记录;\\n3、您的IP：\”&GetIP&\”;\\n4、操作日期：\”&Now&\”;\\n Powered By Kesion.Com!\’);window.close();</script>\” End if Next DelSql = Str End Function