OBLOG js.asp漏洞

漏洞文件：js.asp 看代码 &quot;&quot; And teamid&quot;0&quot; Then teamid=Replace(teamid,&quot;|&quot;,&quot;,&quot;) Sql=Sql &amp; &quot; And teamid In (&quot; &amp; teamid &amp; &quot;) &quot; End If Sql=Sql &amp; &quot; Order by postid Desc&quot; Set rs=oblog.Execute(Sql) sRet=&quot;&quot; Do While Not rs.Eof sAddon=&quot;&quot; sRet=sRet &amp; &quot;&quot; &amp; oblog.Filt_html(Left(rs(2),l)) &amp; &quot;&quot; If u=1 Then sAddon=rs(4) if t=1 Then If sAddon&quot;&quot; Then sAddon=sAddon &amp; &quot;,&quot; sAddon=sAddon &amp; rs(3) End If If sAddon&quot;&quot; Then sAddon=&quot;(&quot; &amp; sAddon &amp; &quot;)&quot; sRet=sRet &amp; sAddon &amp; &quot;&quot; rs.Movenext Loop Set rs = Nothing sRet=sRet &amp; &quot;&quot; Response.write oblog.htm2js (sRet,True) End Sub 很明显就看到TID没有经过过滤就直接递交给TEAMID了 TEAMID只过滤了&quot;|&quot; 就直接进SQL语句了, OBLOG4.0 OBLOG4.5 临时解决办法: 搜索：teamid=Request(”tid”)这个，将这个替换为： teamid=Replace(Replace(request(&quot;tid&quot;),&quot;'&quot;,&quot;&quot;),&quot;)&quot;,&quot;&quot;)， 就是将一些危险字符过滤下就ok了！ 注意一下，下面的这段代码： teamid=Replace(teamid,”|”,”,”) 是将多个tid通过“|”链接起来，然后在这里还原为用“，”链接，以便下面的sql语句中直接使用： If teamid&lt;&gt;“” And teamid&lt;&gt;“0″ Then teamid=Replace(teamid,”|”,”,”) Sql=Sql &amp; ” And teamid In (” &amp; teamid &amp; “) ” End If 官方:<a href="http://www.oblog.com.cn" target="_blank">http://www.oblog.com.cn</a>