发现图书馆网站一个漏洞

只是明白大概……我对jsp理解很肤浅…… 顶哈~：）

tomcat该升级了

恩 的确是漏洞

如果能随便借预约书架上的书就爽了 【 在 BookMoth 的大作中提到: 】 : 攻击图书馆干什么？给个攻击思路。无限期借阅图书？

该换5.0了

<%@ page contentType="text/html;charset=8859_1" %> <%@ page import="java.sql.*"%> <jsp:useBean id="reader_bean" class="reader.reader_bean" scope="page" /> <jsp:useBean id="opac_sql2" class="sql.opac_sql" scope="page" /> <%@ include file="../include/functions.jsp" %> <% try{ String str_kind = null; //str_kind用来标识是第几次访问本页面。＝null第一次进入本页面，显示登录信息；!=null用户点击‘登录’按钮后进入本页面，做登录处理。 if(request.getParameter("str_kind") != null){ String barcode = str_BlankNull(request.getParameter("barcode")); String identification_id = str_BlankNull(request.getParameter("identification_id")); String password = str_BlankNull(request.getParameter("password")); String fangshi = str_BlankNull(request.getParameter("fangshi")); Hashtable callParameter = new Hashtable(); if(fangshi.equals("1")){ callParameter.put("barcode",identification_id); }else{ callParameter.put("barcode",barcode); } callParameter.put("password",password); callParameter.put("identification",fangshi); callParameter = reader_bean.readerLogin(callParameter); String name = toDisplayString((String)callParameter.get("name")); int Msg_no = Integer.parseInt((String)callParameter.get("msg_no")); String Msg = toDisplayString((String)callParameter.get("msg")); barcode = (String)callParameter.get("reader_barcode"); //out.print("<br>Msg_no = "+Msg_no+" Msg = "+Msg+" barcode = "+barcode); /* out.print(str_barcode+"<br>"); out.print(str_name+"<br>"); out.print(int_Msg_no+"<br>"); out.print(str_Msg+"<br>"); */ if ((Msg_no == 3)||(Msg_no == 4)||(Msg_no == 5)){ %> <script language="JavaScript"> alert("<%=Msg%>！"); history.back(); </script> <% }else{ session.setAttribute("loginname", name); session.setAttribute("loginbarcode", barcode); if(Msg_no==2){ %> <script language="JavaScript"> alert("<%=Msg%>！"); </script> <% } %> <SCRIPT LANGUAGE=javascript> window.location="infoList.jsp"; </script> <% } return; } //end of if(request.getParameter("kind") != null) if(request.getParameter("action_kind") != null){ String str_sql = null; ResultSet rs = null; String barcode = request.getParameter("barcode"); String name = request.getParameter("name"); if(barcode != null){ str_sql = "select * from manager.readers where reader_barcode='"+barcode+"'"; }else if(name != null){ str_sql = "select * from manager.readers where reader_name='"+name+"'"; } rs = opac_sql2.executeQuery(str_sql); if(rs.next()){ out.println(rs.getString("reader_barcode")); out.println(rs.getString("reader_name")); out.println(rs.getString("reader_birth")); out.println(rs.getString("reader_pwd")); out.println(rs.getString("reader_addr")); out.println(rs.getString("debt")); } } }//end of try catch(Exception e){ out.print(e.getMessage()); return; } finally{ reader_bean.close(); } //加载头部文件titletype=true:显示头部导航区; =false:不显示================= boolean titletype = true; %> <%@ include file="../include/title.jsp" %> <% try{ //结束加载头部文件======================================================= String str_identification = (String)session.getAttribute("opac_system_parm['identification_id']"); %> <script language="JavaScript"> <!-- function PageFunction(){ form1.barcode.focus(); } //--> </script> <table width="100%" height="300" border="0" cellpadding="0" cellspacing="0"> <tr> <!--左边的使用说明--> <td width="202" height="100%"> <table width="202" height="20" border="0" cellpadding="0" cellspacing="0" background="../images/middle_02.gif"> <tr> <td width="75"><img src="../images/middle_01.jpg" width="57" height="20"></td> <td class="opac_red"><img src="../images/biao_book.gif" width="6" height="9"> &nbsp;使用说明</td> <td width="7"><img src="../images/middle_03.jpg" width="7" height="20"></td></tr> </table> <table width="202" height="100%" border="0" cellpadding="0" cellspacing="0" background="../images/right_bg_01.gif"> <tr> <td height="100%" valign="top"><br><ol> <% if(str_identification.equals("1")){ //如果允许通过学生证号登录 %> <li>读者输入读者条码(学生证号)、口令，进行登录。<br> 其中读者条码和学生证号二者必选其一；若没有设置读者口令，读者口令可不必填写就能登录本系统，登录后在“修改读者信息”中设置自己的密码；</li> <% } else{ //如果不允许通过学生证号登录 %> <li>读者输入读者条码、口令，进行登录。<br> 若没有设置读者口令，读者口令可不必填写就能登录本系统，登录后在“修改读者信息”中设置自己的密码；</li> <% } %> <li>登录成功后，系统显示该读者的预约情况和借阅情况;</li> <li>读者也可点击“修改读者信息”,修改自己的口令和E-MAIL;</li> <li><font color=ff0000>系统升级需更改密码：<br>1).原有密码是数字的继续沿用；<br>2). 原有密码中含有字母的，建议全部改为数字；<br>3).原来密码为空的且证内有钱的，请到图书馆流通部增改密码。<br>4).密码需小于10位，大于10位的密码现为原密码的前10位。<br>谢谢合作！</font> </li> </ol> </td> </tr> </table></td><!--结束左边的使用说明--> <!--右边的检索条件录入界面--> <td height="100%"> <table width="100%" height="20" border="0" cellpadding="0" cellspacing="0" bgcolor="#EFEBEF"> <tr> <td width="45" align="right" background="../images/middle_04.gif"> <img src="../images/biao_arrow.gif" width="18" height="16">&nbsp;</td> <td width="90" valign="baseline" background="../images/middle_04.gif" class="big">读者信息</td> <td width="23"><img src="../images/middle_05.gif" width="23" height="20"></td> <td valign="bottom" background="../images/middle_06.gif"> <table height="16" border="0" cellpadding="0" cellspacing="0"> <tr> <td class="opac_blue" width="90" align="center" valign="baseline" background="../images/middle_07.gif"> <img src="../images/biao_doc_blue.gif" width="7" height="7"> 读者登录 </td> <td width="2"><img src="../images/middle_08.gif" width="2" height="15"></td> <td width="1"><img src="../images/middle_09.gif" width="1" height="16"></td> </tr> </table></td> <td width="73" background="../images/top_bg_03.gif" bgcolor="#426994">&nbsp;</td> </tr> </table> <table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0" bgcolor="#F7FBFF"> <tr> <td align="center"> <img src="../images/space.gif" width="577" height="1"> <Form method="POST" action="?str_kind=login" name=form1 onsubmit="javascript:return Juge(this)"> <table border=0 cellPadding=0 cellSpacing=0> <tr><td colspan=2 align="center" class="opac_blue"> :: 读者登录 ::</td></tr> <tr><td colspan=2 height="1" background="../images/doc_01.gif"></td></tr> <tr><td><br></td></tr> <% if (str_identification.equals("1")){ //如果允许通过学生证号登录 %> <tr> <td width="10%" align=right><input type="radio" name="fangshi" value="0" checked id="aa"></td> <td width="90%">读者条码： <input type="text" name="barcode" class=input_text onfocus="judge(aa,identification_id)" tabindex=1></td> </tr> <tr> <td align=right><input type="radio" name="fangshi" value="1" id="bb"></td> <td>学生证号： <input type="text" name="identification_id" class=input_text onfocus="judge(bb,barcode)" tabindex=2></td> </tr> <% } else{ //如果不允许通过学生证号登录 %> <tr> <td>&nbsp;</td> <td>读者条码： <input type="text" name="barcode" class=input_text tabindex=3></td><!--onKeyUP ="if (event.keyCode == 13) return Juge(this);"--> <input type="hidden" name="fangshi" value="0" > </tr> <% } %> <tr><td><br></td></tr> <tr><td>&nbsp;</td> <td>读者口令： <input type="password" name="password" class=input_text tabindex=4></td> </tr> <tr><td colspan=2><br></td></tr> <tr><td colspan=2 align=right height="1" background="../images/doc_01.gif"></td></tr> <tr><td colspan=2 align="right"> <br><input type="image" src="../images/login.gif"></td></tr> </table> </form><br> </td> <td width="1" bgcolor="#426994"><img src="../images/space.gif" width="1" height="1"></td> </tr> </table> </td><!--结束右边的检索条件录入界面--> </tr> </table> <% int cp = 2; //cp=1:底部文件一栏; =2:底部文件两栏样式%> <%@ include file="../include/copyright.jsp" %> <% }//end of try //Exception handling catch(Exception e){ //response.sendRedirect("../error.jsp?msg='"+e.getMessage()+"'"); out.print(e.getMessage()); return; } finally{ reader_bean.close(); opac_sql2.close(); } %>

斑竹来组织大家修复漏洞

if(request.getParameter("action_kind") != null){ String str_sql = null; ResultSet rs = null; String barcode = request.getParameter("barcode"); String name = request.getParameter("name"); if(barcode != null){ str_sql = "select * from manager.readers where reader_barcode='"+barcode+"'"; }else if(name != null){ str_sql = "select * from manager.readers where reader_name='"+name+"'"; } rs = opac_sql2.executeQuery(str_sql); if(rs.next()){ out.println(rs.getString("reader_barcode")); out.println(rs.getString("reader_name")); out.println(rs.getString("reader_birth")); out.println(rs.getString("reader_pwd")); out.println(rs.getString("reader_addr")); out.println(rs.getString("debt")); } } 地址栏里输入action_kind=fuck&barcode=就认为你已经登录了，能查此人的密码，欠费，姓名。也可以输入name=根据姓名查询 不过图书馆改版了