Shulou(Shulou.com)06/01 Report--

Production environment:

Operating system: Window Sever 2003

Database system: SQL Server 2005

WEB server: IIS 6. 0

Problem: the bottom of the secondary website is injected with garbled code, similar to some links.

Analyze and solve problems:

1. Find the corresponding program page to view the source code. There is no such garbled code in the source code, indicating that the garbled code is injected into the database.

Yes, it's some random data.

two。 Through the analysis of the corresponding program page to find the corresponding database table, select, found 4625 rows, and found some garbled on similar pages, through the SQL statement: "delete * from tb_link where id > '20160810054001'", you can delete these garbled codes. Through the browser access, it is found that the garbled code no longer exists.

3. The key is to solve the fundamental problem. I personally feel that security protection should be strengthened from the following aspects:

The write permission attribute is removed from the program code, and only user users are allowed to write to the database and picture folders.

Close remote Desktop connection

Shut down the 1433 SQL database port

Scan the system and program code with antivirus software

Check the program code for unknown code or *

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.