' H& h x1 M* P% K& s, B2 }SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试9 W5 ^- f T f- g$ w# R+ y
详细说明：; C1 A [! @( B9 p1 @- H; j
Islogin //判断登录的方法2 z% V8 q, J* X, N8 p7 |
3 |4 A! h4 F! [* ]0 C: k7 u$ Vsub islogin() . U3 }: A! w8 B& f1 z8 v' W& b ' k. m$ K1 K$ f' k3 {3 yif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then ' q! E- ?# b1 J' \* U8 x : r+ A, T5 q- z3 N2 }% V$ y9 H
dim t0,t1,t2 ( J# m9 ?2 v- o % ^$ }- e* [" {* `) U. h/ S" R
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie # ?& F+ G8 R% Z8 O# \# V; ^6 e
$ t2 }( Z( N7 J/ S
t1=sdcms.loadcookie("islogin") 8 |: L V3 D% Z w5 y% R 6 @) G, Z0 @9 d- Et2=sdcms.loadcookie("loginkey") * ]" q: F* O- F, ?* \, j1 i) S2 p/ p% p+ H 9 k; G" v) Y2 q1 S5 M, ^; }
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行 8 | c- I' O, z4 F n+ F' ~3 o; c$ L3 @1 ~ j/ ]
//% q: _. D( p; D/ _* y9 z9 d
. }6 l3 h0 I' P. L0 i5 q( m( K+ I
sdcms.go "login.asp?act=out"! g' D% ] K5 u# c% j' O
! M/ @4 h2 r( u/ ]" C
exit sub+ A% F" w2 k8 L
8 n, q/ N; s3 P( e: ^' c( E
else/ K2 ~ m' H0 L& l, e5 c; c5 s s, l
8 [ d. U+ n& h% Z
dim data " Z7 w+ h3 B- c l* ~ & j, N. t- x( xdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控 ; U. j+ ^3 {2 l* O & w# ~) R% r; J5 Y. o9 t6 P; \# |3 r7 t
if ubound(data)<0 then! U1 y' r9 Q6 R; ]+ S# @3 b/ ^
, m$ C. f+ U- `7 T$ ]3 ?* U% o5 Lsdcms.go "login.asp?act=out" h% t4 [# ~# V2 v( L4 Z 5 U$ }6 I5 j8 O. c& W: Z
exit sub+ g" q8 V3 Z, W- M
+ G( i# M; w. D$ N$ o/ belse ; c, O7 ~* T6 A. J; R . U Y; d& j+ a' \
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then % J; `. E6 r! I5 x3 i% W6 r ) m+ L9 T3 E1 B4 J" d" ?8 E
sdcms.go "login.asp?act=out"( B5 Z' d% n5 Z; ~/ O7 @
* d! R8 Z$ @% T3 M: Wexit sub% g+ `! R2 c9 F) d
4 U& `+ y0 Y5 V! Y9 O, Belse7 ~7 l- A0 C/ Q0 B& o
+ \3 \6 X5 j( a( s6 q
adminid=data(0,0)/ }( J0 e7 h: h K
, w% t2 r7 ~! F3 ?3 S% Fadminname=data(1,0)+ Y, w. T+ m+ t; G
0 S/ o3 F8 Y7 h8 B% Q! }8 O
admin_page_lever=data(5,0), j1 r1 s) n7 B2 }+ d {6 w2 y
l9 W2 i# a& u9 }5 @; Q
admin_cate_array=data(6,0) % ~. U1 C( l( A' ]; Y + n& D3 Z/ J; U3 }! U( A. @8 Uadmin_cate_lever=data(7,0)" @7 C. {1 h4 g$ o+ ?+ a+ A: C
) \& N! Y( V- wif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0 % L- t+ Z7 s2 q C @ 1 h5 ]9 C' p" I9 ~+ a5 |if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0 4 N; {2 O2 W) y; i+ [/ X O 6 @# {6 K y! }* w" E* t% g
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0/ H- W9 w) x W; I9 t" ]5 `
0 q: B* X* e+ }if clng(admingroupid)<>0 then ( R( F* c# T7 [) \! O / | t- E" p5 H1 u( h6 T
admin_lever_where=" and menuid in("&admin_page_lever&")" " z% U' F* T( y) i- C ; y1 L: a/ [0 v' r% Eend if " d# ~# Q' ~( G/ I6 `. o- ] * C8 \. N' R# e6 _
sdcms.setsession "adminid",adminid- o/ f! Z# Y. z
0 x! l& s# b. f( Z( hsdcms.setsession "adminname",adminname & N7 p0 Y" ^" N. b* ^, X/ h: I. E ! ~6 s' O' k4 f; ~& D4 @" A3 r
sdcms.setsession "admingroupid",data(4,0)* x& `6 y* @* v$ R; A7 f7 r! H
5 n8 d4 z, s: _* J& O# S! }
end if 4 h8 i0 k- G7 V' L1 o1 j! |0 Y3 ] % O- q+ c9 v5 d9 p7 D* j/ zend if }. g2 h% {& ]9 v+ L7 c- t8 { . k8 x2 s& }' z4 X* F( `end if& b) K; Q2 \) {, k% a2 |
7 A+ i2 [& m. V/ P3 U+ ]else " K; {( _8 J4 y; y , O7 M/ Z* K8 j+ c& C# [! K+ O+ \data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","") v# ~" }1 J1 z+ C8 d' E4 d
) }3 g, M; F* r5 iif ubound(data)<0 then" Y1 u5 C+ ?$ K# T
% D' K; B* ^6 V1 P8 Isdcms.go "login.asp?act=out" ' h* v3 }) F) e % f% {! T# X( _& O/ J2 qexit sub $ `$ Z! W6 f+ D1 l0 U& r 0 E+ S7 d' D: X& h3 q5 Aelse 7 g# O# {: \1 s% l& h3 F2 } 8 y: @) L0 i% Q5 Gadmin_page_lever=data(0,0) 1 I% V0 r7 Q: a& w 3 V# y9 H! e. c. B! |2 n+ r4 P
admin_cate_array=data(1,0) % a+ J) J9 g5 ~7 v# ]7 \ + R; K3 B+ M3 D g9 l: q R$ p* madmin_cate_lever=data(2,0) ; Z! p% R8 R( o/ V* ]1 {% T ^+ V 5 t0 C8 Q& ?5 {8 x% Q. e# L! o
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0 0 e5 J1 Q6 W$ d/ [) U, i + K G% A; s# O; P" yif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0 4 U3 M9 v U' z- g6 v ' |# E. O/ Y7 F/ L4 r' Sif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0 & T# N$ @; Z+ r: A6 o 8 J7 Z, X: r/ t( z, [+ pif clng(admingroupid)<>0 then0 a }2 L; f4 i3 p! }
' A7 h: F0 J {# d4 x) j: qadmin_lever_where=" and menuid in("&admin_page_lever&")" # Z) V% H& R+ i1 v7 T: T, y " p; a* K( r, `, Eend if$ v- |& T n' \$ g& y' A
9 k' i/ l% `) f l' o, yend if- C- Z% Y( F! ^& C1 x
, h, ~7 K+ l/ A, }0 h2 H3 Hend if3 _/ } M) C4 j+ k& P7 l
8 K9 V% O0 g: m# E% a; Nend sub ; P, r9 [- n Q4 I7 K! a漏洞证明： & k4 ]6 X# v& B6 j8 o8 a# n看看操作COOKIE的函数9 i' v: K+ m& Y" s# L3 [) t9 G
. N1 q. ]- G z. A* ?3 c W! a
public function loadcookie(t0)+ [4 z( z9 J5 A# a6 a* u) f