The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Example 2: Injecting via ASP

Consider the following ASP code, which is part of a web application for

administering a web server. The function allows administrators to view the

contents of a requested log file:

<%

Set oScript = Server.CreateObject(“WSCRIPT.SHELL”)

Set oFileSys = Server.CreateObject(“Scripting.FileSystemObject”)

szCMD = “type c:\inetpub\wwwroot\logs\“ & Request.Form(“FileName”)

szTempFile = “C:\“ & oFileSys.GetTempName()

Call oScript.Run (“cmd.exe /c “ & szCMD & “ > “ & szTempFile, 

0, True)

Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0)

%>