WooYun.org

<!--#include file="../inc/Main_Class.asp"-->
<%
'****************************************************
'Code for IdeaCMS
'****************************************************
dim action,str,page,sql,MesTitle,LinkName,Content,validcode,Company,Address,Telephone,Email,back
action=filterPara(getForm("action","get")) : str=filterPara(getForm("str","get")) : page=filterPara(getForm("page","get"))
MesTitle=filterPara(getForm("MesTitle","post")) : LinkName=filterPara(getForm("LinkName","post")) : Content=codeTextarea(filterPara(getForm("Content","post")),"en")
Company=filterPara(getForm("LinkComp","post")) : Address=filterPara(getForm("LinkAddr","post")) : Telephone=filterPara(getForm("LinkTel","post")) : Email=filterPara
(getForm("LinkEmail","post"))
back="GuestBook.asp"
if action="add" then
    if isNul(Content) then alertback "内容为空！"
    validcode = replace(filterPara(getForm("input_yzm","post")),"'","")
	if Session("GetCode")<>validcode then
	    alert "验证码错误！",back
	else
		sql="insert into {pre}GuestBook(MesTitle,LinkName,Content,Company,Address,Telephone,Email) values
('"&MesTitle&"','"&LinkName&"','"&Content&"','"&Company&"','"&Address&"','"&Telephone&"','"&Email&"')"
		conn.db sql,"0"
		if err then err.clear : alert "留言添加失败",back else if cint(guestmode)=1 then alert "留言添加成功,将在审核后显示!",back else alert "留言添加成
功!",back
	end if
end if
if isNul(page) then 
	page=1 
else 
	if isNum(page) then page=clng(page) else alert "参数错误！",back
end if
dim templateobj,channelTemplatePath : set templateobj = mainClassobj.createObject("MainClass.template")
dim channelTemplateName,channelStr
channelTemplatePath = PubPath("guestbook.html")
with templateObj : .load(channelTemplatePath) : .parseComm() : .parseColumn() : .parseChannel("") : .parseList 0,page,"guestlist","" : .parseIf() : channelStr = 
.content : end with
if str="签写留言" then
    channelStr = replace(channelStr,"id=guestlist>","id=guestlist style=display:none>")
	channelStr = replace(channelStr,"id=guestwrite style=display:none>","id=guestwrite>")
end if
Echo channelStr
set templateobj =nothing : terminateAllObjects
%>
跟踪
getForm 和 filterPara
Function getForm(element,mtype)
	Select case mtype
		case "get"
			getForm=trim(request.QueryString(element))
		case "post"
			getForm=trim(request.Form(element))
		case else
			if isNul(request.QueryString(element)) then getForm=trim(request.Form(element)) else getForm=trim(request.QueryString(element))
	End Select
End Function
去掉空格
继续跟踪函数
Function filterPara(byVal Para)
    filterPara=preventSqlin(filterStr(Para,"jsiframe"))
End Function
先来看看
Function preventSqlin(content)
	dim sqlStr,sqlArray,i,speStr
	sqlStr="%27|*|and|exec|dbcc|alter|drop|insert|select|update|delete|count|master|truncate|char|declare|where|set|declare|mid|chr"
	if isNul(content) then Exit Function
	sqlArray=split(sqlStr,"|")
	for i=lbound(sqlArray) to ubound(sqlArray)
		if instr(lcase(content),sqlArray(i))<>0 then alertback "你提交的数据含非法字符" : Exit Function
	next
	preventSqlin=content
End Function
你还想注入么????
再看
'去除html格式
Function filterStr(Byval str,Byval filtertype)
	if isNul(str) then  filterStr = "" : Exit Function
	dim regObj, outstr,rulestr : set regObj = New Regexp
	regObj.IgnoreCase = true : regObj.Global = true
	Select case filtertype
		case "html"	
			rulestr = "(<[a-zA-Z].*?>)|(<[\/][a-zA-Z].*?>)"
		case "jsiframe"
			rulestr = "(<(script|iframe).*?>)|(<[\/](script|iframe).*?>)"
	end Select
	regObj.Pattern = rulestr
	outstr = regObj.Replace(str, "")
	outstr=replace(outstr,"{ideacms:page}","")
	outstr=replace(outstr,"&nbsp;","")
	set regObj = Nothing : filterStr = outstr
End Function
这是过滤html么