在互联网信息服务中配置时 ASP.net 网站无法正常工作

本文关键字:常工作 工作 网站 net 网信息 服务 ASP 配置 | 更新日期: 2023-09-27 17:56:20

我在 ASP.net 中使用前端的 c# 和后端的 oracle 11g 创建了小网页。网页在我的本地PC以及Visual Studio 2010中的Windows Server 2008 r/2中成功运行。因此,当我尝试通过IIS页面"浏览"同一页面时,我在服务器2008 r/2的IIS中配置了相同的wabpage页面正在运行,但是当我单击任何显示错误的按钮时,页面有3个按钮。服务器和我的电脑都在同一个网络中。因此,当我浏览同一网页时,从我的电脑上,它正在运行,但是当我单击按钮时出现与 IIS 中相同的错误

综上所述,简单静态页面在IIS和本地PC中成功运行,但动态页面意味着如果任何事件(按钮单击)包括数据库连接会出错。

其他信息 - Windows Server 2008 r/2 - 64 位基于 .NET Framework 4 的网页构建VS 2010 - 配置属性 - 调试 - 任何PC - 内部版本 已检查

我的代码:-

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.OracleClient;
using System.Data;
public partial class Delivery_Delete : System.Web.UI.Page
{
DataSet ds = new DataSet();
OracleConnection con = new OracleConnection("Data Source=10.31.41.103/ORCL;User ID=RL_PET;Password=RL_PET;Unicode=True");
protected void Page_Load(object sender, EventArgs e)
{
}
protected void Button1_Click1(object sender, EventArgs e)
{
    con.Open();
    OracleDataAdapter a = new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "'", con);
    a.Fill(ds);
    if (String.IsNullOrEmpty(TextBox1.Text))
    {
        string display = "Please enter report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows.Count == 0)
    {
        string display = "Please check report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else
    {
        GridView1.DataSource = ds;
        GridView1.DataBind();
        GridView1.Visible = true;
        con.Close();
    }
}
protected void Button2_Click(object sender, EventArgs e)
{
    con.Open();
    OracleDataAdapter a = new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "' ", con);
    a.Fill(ds);
    if (String.IsNullOrEmpty(TextBox1.Text))
    {
        string display = "Please enter report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows.Count == 0)
    {
        string display = "Please check report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else
    {
        OracleConnection con1 = new OracleConnection("Data Source=10.31.41.103/ORCL;User ID=RL_PET;Password=RL_PET;Unicode=True");
        con1.Open();
        OracleDataAdapter a1 = new OracleDataAdapter("SELECT DATA_STS FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' AND DATA_STS = 0", con1);
        if (ds.Tables[0].Rows[0].ItemArray[0] == "0")
        {
            OracleCommand cmd = con1.CreateCommand();
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "UPDATE WI_TO SET ORD_STS = 'D' WHERE TO_NO = '" + TextBox1.Text + "' ";
            cmd.ExecuteNonQuery();
            string display = "Delivery has been removed from ASRS...!!!";
            ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
        }
        else
        {
            string display = "Please cancel MPN first...!!!";
            ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
            con.Close();
        }
    }
}
protected void Button3_Click(object sender, EventArgs e)
{
    OracleDataAdapter a = new OracleDataAdapter("SELECT ORD_STS FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "'  OR TRUCK_NO = '" + TextBox1.Text + "'", con);
    a.Fill(ds);
    if (String.IsNullOrEmpty(TextBox1.Text))
    {
        string display = "Please enter report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows.Count == 0)
    {
        string display = "Please check report no. or truck no...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
    else if (ds.Tables[0].Rows[0].ItemArray[0].ToString() == "D")
    {
        con.Open();
        OracleCommand cmd = con.CreateCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "UPDATE WI_TO SET ORD_STS = 'C' WHERE TO_NO = '" + TextBox1.Text + "' ";
        cmd.ExecuteNonQuery();
        string display = "Delivery has been successfully inserted in ASRS...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
        con.Close();
    }
    else
    {
        string display = "Delivery in ASRS...!!!";
        ClientScript.RegisterStartupScript(this.GetType(), "myalert", "alert('" + display + "');", true);
    }
}

}

错误:-尝试加载格式不正确的程序。(HRESULT的例外:0x8007000B)

说明:执行当前 Web 请求期间发生未经处理的异常。请查看堆栈跟踪,了解有关错误及其在代码中起源位置的详细信息。

异常详细信息:System.BadImageFormat异常:尝试加载格式不正确的程序。(HRESULT的例外:0x8007000B)

源错误:

第 22 行:数据集 ds = 新数据集();第 23 行:OracleConnection con = new OracleConnection("数据源=10.31.41.103/ORCL;用户 ID=RL_PET;密码=RL_PET;Unicode=True");第 24 行:骗局打开();第 25 行:OracleDataAdapter a = new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO 其中 TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "'", con);第 26 行:a.填充(ds);

源文件:e:''Portal_Final''传递删除.aspx.cs行:24

堆栈跟踪:

[BadImageFormatException:尝试加载带有
格式不正确。(HRESULT的例外:0x8007000B)] System.Data.Common.UnsafeNativeMethods.OCILobCopy2(IntPtr svchp, IntPtr errhp, IntPtr dst_locp, IntPtr src_locp, UInt64 amount, UInt64 dst_offset, UInt64 src_offset) +0 System.Data.OracleClient.OCI.DetermineClientVersion() +284[InvalidOperationException:尝试加载 Oracle 客户端库时抛出了 BadImageFormatException。 在安装了 32 位 Oracle 客户端组件的 64 位模式下运行时,会出现此问题。 System.Data.OracleClient.OCI.DetermineClientVersion() +1058 System.Data.OracleClient.OracleInternalConnection.OpenOnLocalTransaction(String userName, String password, String serverName, Boolean integratedSecurity, Boolean unicode, Boolean omitOracleConnectionName) +70 System.Data.OracleClient.OracleInternalConnection..ctor(OracleConnectionString connectionOptions) +136 System.Data.OracleClient.OracleConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningObject) +58 System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options) +49 System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject) +984 System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject) +91 System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject) +1908 System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection) +85 System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) +270 System.Data.OracleClient.OracleConnection.Open() +48 Delivery_Delete.Button1_Click1(对象发送器,事件参数 e) 在 e:''Portal_Final''传递删除.aspx.cs:24 System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +154 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3394

在互联网信息服务中配置时 ASP.net 网站无法正常工作

我没有亲自使用 Oracle 数据库,但从您的堆栈跟踪中我看到以下错误:

尝试加载 Oracle 客户端库时抛出了 BadImageFormatException。在安装了 32 位 Oracle 客户端组件的 64 位模式下运行时,会出现此问题。

看看这里类似的问题:BadImageFormatException。在安装了 32 位 Oracle 客户端组件的 64 位模式下运行时,将发生这种情况


这与您的原始问题无关,我不是安全分析师,但您的代码有几个SQL注入攻击的警告信号,如果这是针对生产站点的,请确保来自客户端的任何数据都经过清理,然后再将其用于查询。

恶意用户可能会使用以下代码在数据库中执行几乎任何操作:

new OracleDataAdapter("SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = '" + TextBox1.Text + "' OR TRUCK_NO = '" + TextBox1.Text + "'", con);

如果用户在文本框中输入以下文本1

';从WI_TO中选择 * --

生成的查询将是:

SELECT TO_NO, MERGE, TRUCK_NO, CUST_NM, QTY, PLANT_CD, DATA_STS, ORD_STS, MPNSEQ_NO, DEL_NO FROM WI_TO WHERE TO_NO = ''; SELECT * FROM WI_TO --' OR TRUCK_NO = ''; SELECT * FROM WI_TO --'

在这种情况下,select 语句可能相对无害,但想象一下,如果它是一个删除,它可能是删除数据库中任何表中任何数据的语句。

以下是几个链接,可了解有关此类攻击的更多信息。

https://msdn.microsoft.com/en-us/library/ff648339.aspx