绕过了那个很简单的防注入。直接可以update管理员密码。
页面的按钮点击事件:
protected void Btn_Click调用了b_Arrive.UpdateState(text); public bool UpdateState(string ArriveNo) { string sqlStr = "Update ZL_Arrive SET State =1 WHERE ArriveNO=’" + ArriveNo + "’"; ///果断注入 return SqlHelper.ExecuteSql(sqlStr); }
public static void StartProcessRequest() { try { if (HttpContext.Current.Request.QueryString != null) { for (int i = 0; i < HttpContext.Current.Request.QueryString.Count; i++) { string getkeys = HttpContext.Current.Request.QueryString.Keys; if (!DataSecurity.ProcessSqlStr(HttpContext.Current.Request.QueryString[getkeys])) { function.WriteErrMsg("数据不能包含SQL注入代码!"); HttpContext.Current.Response.End(); } } } if (HttpContext.Current.Request.Form != null) { for (int j = 0; j < HttpContext.Current.Request.Form.Count; j++) { string getkeys = HttpContext.Current.Request.Form.Keys[j]; if (!DataSecurity.ProcessSqlStr(HttpContext.Current.Request.Form[getkeys])) { function.WriteErrMsg("数据不能包含SQL注入代码!"); HttpContext.Current.Response.End(); } } } } …… }
里面还调用到一个DataSecurity.ProcessSqlStr
public static bool ProcessSqlStr(string Str) { bool ReturnValue = true; Str = Str.ToLower(); try { if (Str != "") { string SqlStr = "and |exec |insert |select |delete |update |count |chr |mid |master |truncate |char |declare "; string[] anySqlStr = SqlStr.Split(new char[] { ’|’ }); string[] array = anySqlStr; for (int i = 0; i < array.Length; i++) { string ss = array; if (Str.IndexOf(ss) >= 0) { ReturnValue = false; } } } } catch { ReturnValue = false; } return ReturnValue; }