### 简要描述：
某通用在线考试系统可getshell、注册管理员等
### 详细说明：
上海天柏信息科技有限公司的系统：
测试地址：http://www.timber2005.com/Product_sy.html
demo：
http://exam1.timber2005.com/login.aspx
首先注册一个普通账号：
[<img src="https://images.seebug.org/upload/201409/14162138d5881133c4e95f98b25650a20c465267.jpg" alt="21.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162138d5881133c4e95f98b25650a20c465267.jpg)
然后登陆：
[<img src="https://images.seebug.org/upload/201409/141622482d992d1840ffba7a4a48fb7ceb3c3a7e.jpg" alt="22.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141622482d992d1840ffba7a4a48fb7ceb3c3a7e.jpg)
之后直接访问：
http://exam1.timber2005.com/system/system_config.aspx
[<img src="https://images.seebug.org/upload/201409/141625110d99a02f23a89571cb9a60efd021a5db.jpg" alt="23.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141625110d99a02f23a89571cb9a60efd021a5db.jpg)
-=======================================================
这里有两个问题：
1.修改注册，直接注册管理员：
[<img src="https://images.seebug.org/upload/201409/141626289a5e652121ca949c724e9b8346bd074d.jpg" alt="24.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141626289a5e652121ca949c724e9b8346bd074d.jpg)
然后去注册，直接就是管理员：
[<img src="https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg" alt="25.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg)
=====================================================
第二个问题，可以上传任意文件：
抓包，修改文件名,即可上传成功：
[<img src="https://images.seebug.org/upload/201409/14163337489d62ec352f68b85599b6ae9bc4d6b0.jpg" alt="26.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14163337489d62ec352f68b85599b6ae9bc4d6b0.jpg)
这里服务器限制了目录执行权限：
[<img src="https://images.seebug.org/upload/201409/14163539b7f0adb9a13ec0d45c8eee68964fe857.jpg" alt="27.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14163539b7f0adb9a13ec0d45c8eee68964fe857.jpg)
我们找一个同一个系统没有限制的：
[<img src="https://images.seebug.org/upload/201409/141641597eb70053670ab971bbc0488fefcfb016.jpg" alt="28.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141641597eb70053670ab971bbc0488fefcfb016.jpg)
http://zx.gzzkzsw.com/UpLoad/System/20140914164100746093.aspx
[<img src="https://images.seebug.org/upload/201409/141642145d1de16378a13e73b24107e4673f3ad2.jpg" alt="29.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/141642145d1de16378a13e73b24107e4673f3ad2.jpg)
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg" alt="25.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201409/14162941fdc78cf8f1ac668d0f5653843208a96e.jpg)
http://exam1.timber2005.com/UpLoad/System/picture/20140914163514890625.txt
http://zx.gzzkzsw.com/UpLoad/System/20140914164100746093.aspx
京ICP备10040895号
暂无评论