涉及程序： Snitz Forums 2000 描述： Snitz Forums 2000 存在跨站脚本执行缺陷 详细： Snitz Forums 2000是一款优秀的ASP电子公告牌系统。Snitz Forums 2000的BadWord(脚本)过滤器存在缺陷，攻击者通过在脚本命令中添加Tab-Char (0x09)，能对过滤器进行哄骗，导致产生跨站脚本攻击。 攻击者通过精心构造的下列格式的字符串能使用该缺陷： jav asc ript:alert%28document.cookie%29 攻击方法： 示例代码： jav asc ript:alert%28document.cookie%29 解决方案： 目前厂商未公布该缺陷补丁，请用户及时关注厂商站点： http://forum.snitz.com/ 第三方补丁： File: inc_func_common.asp Function ReplaceURLs ... ... ` bWM Patch ----------------------------------------------------------------------------- strArray2(0) = replace(strArray2(0), vbTab, "") `<-- -- -- ADD THIS LINE \` --------------------------------------------------------------------------------------- strArray2(0) = replace(strArray2(0), \"\"\"\", \" \") \` ## filter out \" \`strArray2(0) = replace(strArray2(0), \"&\", \" \", 1, -1, 1) \` ## filter out & \`strArray2(0) = replace(strArray2(0), \"#\", \" \", 1, -1, 1) \` ## filter out # strArray2(0) = replace(strArray2(0), \";\", \" \", 1, -1, 1) \` ## filter out ; ... ... ... ... \` bWM Patch ----------------------------------------------------------------------------- strArray2(0) = replace(strArray2(0), vbTab, \"\") \`<-- -- -- ADD THIS LINE \` --------------------------------------------------------------------------------------- strArray2(0) = replace(strArray2(0), \"\"\"\", \" \") \` ## filter out \" \`strArray2(0) = replace(strArray2(0), \"&\", \" \", 1, -1, 1) \` ## filter out & \`strArray2(0) = replace(strArray2(0), \"#\", \" \", 1, -1, 1) \` ## filter out # strArray2(0) = replace(strArray2(0), \";\", \" \", 1, -1, 1) \` ## filter out ; ... ... End Function Function ReplaceImageTags ... ... strArray2 = split(strArray(counter2), cTag, -1) strUrlText = trim(strArray2(0)) \` bWM Patch ----------------------------------------------------------------------------- strUrlText = Replace(strUrlText, vbTab, \"\") \`<-- -- -- ADD THIS LINE \` --------------------------------------------------------------------------------------- strUrlText = replace(strUrlText, \"\"\"\", \" \") \` ## filter out \" \`## Added to exclude Javascript and other potentially hazardous characters strUrlText = replace(strUrlText, \"&\", \" \", 1, -1, 1) \` ## filter out & strUrlText = replace(strUrlText, \"#\", \" \", 1, -1, 1) \` ## filter out # strUrlText = replace(strUrlText, \";\", \" \", 1, -1, 1) \` ## filter out ; strUrlText = replace(strUrlText, \"+\", \" \", 1, -1, 1) \` ## filter out + strUrlText = replace(strUrlText, \"(\", \" \", 1, -1, 1) \` ## filter out ( ... ... End Function