要描述：- @3 t+ `% S9 P: _1 v& {; c
* _- t/ I! f1 L. JSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试7 |) [5 Q, D+ Q8 j
详细说明：
5 K1 P0 B( t* w4 EIslogin //判断登录的方法
) P$ r4 i7 l6 ]) I# Q - |" X0 b: K4 ~0 ~3 e$ Q8 ?9 E/ b
sub islogin()
% w& k( x& c7 ]0 T, d; P
5 Y+ _0 k) P7 l4 uif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then 4 _' N4 O& X5 h0 @) D* X# R7 N
' \( e8 {0 b6 D! c }
dim t0,t1,t2 - o Y6 Y i7 m( o8 Z, O
/ \! g; Q5 j; I+ n! z
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
9 w$ Q8 o' j, b! F$ k4 J, u
2 I3 S( p8 X+ bt1=sdcms.loadcookie("islogin")
7 q( b* `! D' m5 f+ `- J ' l* X' }& B, w) H0 q5 K
t2=sdcms.loadcookie("loginkey")
" {1 D7 X% i$ z
/ g; q9 _; H: F7 \; R0 E/ iif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行1 p3 k8 h5 Z( G s( B; L
/ O5 K9 L3 `' t$ g! R& a& I; h4 a3 i m
//
8 q8 F) i9 J- [7 t) ~ $ b& c% B9 q( i( \ X5 ]' W
sdcms.go "login.asp?act=out"
. s c* e; I5 L3 [: I- ]4 j 5 C( K. S6 E2 t# F( i
exit sub
" j8 m$ G7 h' ?% r! g2 j - W) b& {$ g2 F7 V* \. H. S3 o
else
. b, H: G, E& v, |! _
7 O7 y# z( B4 c: ^dim data# }" X8 x2 m0 e! ~' z- F$ j
/ f2 F7 w# h/ O+ p# }5 ?
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控, B0 c( \: J; `# d( T
9 x. M# g2 X' b% R! qif ubound(data)<0 then
1 k. d$ G/ d1 @1 E0 j , e$ }! z' N/ H* k
sdcms.go "login.asp?act=out"" g: J4 t9 y2 E p- S3 W0 o& a) ?0 {) z B
7 \4 L9 { {4 [) ^$ M
exit sub
2 C0 `& K+ u) |$ S
2 Z0 L4 p7 B% ]+ T4 |9 Gelse) V/ F' Z8 z+ I
* Y+ ?1 n1 v- \. R' eif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then" x0 s. N' @% Q2 j, g" J& R$ d2 M
5 x% B7 J6 x% G7 M0 p9 R1 zsdcms.go "login.asp?act=out"3 T' S. \% u/ C6 [3 N) j- _# v2 }
6 R6 E5 N2 m' y( y
exit sub
, h3 V, _1 @7 Y' e, V" q1 C% ~0 f * O+ g3 }1 K& G
else2 K% h1 s: u0 R' o$ d, \; v
; n( \7 a5 @( o8 {+ u4 G3 @$ Radminid=data(0,0)
# n- S. Y, I, ?+ y
8 A4 S; X3 S6 Uadminname=data(1,0)
+ D3 l, \3 b& l$ p5 c3 P/ x* t ! a. T% O5 X8 H. S( _* m
admin_page_lever=data(5,0)
9 y) L- f: J Q" a) @7 B s1 |8 ?, g0 o. n8 k- v: D9 L3 Y
admin_cate_array=data(6,0)
( v9 Z9 q# d. G; m
5 L7 W2 E' w% H$ f& Cadmin_cate_lever=data(7,0)
. [$ ]5 ^4 N# g1 \# e/ m L: J . ~: q9 x& o, i q. D" E
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
1 o- M; T0 {: _
4 e& r# C$ _! j! u4 z3 V% Kif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=05 @1 F) N9 T/ _4 ~, i
4 L4 c0 C( q& i: {
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0! B- b! M$ U2 Z+ ~
+ r) \* D$ j+ f% s" Y. Dif clng(admingroupid)<>0 then
6 ~4 ^7 h) B4 ^
* E9 |: @, ~0 }1 r( Gadmin_lever_where=" and menuid in("&admin_page_lever&")"
1 h/ [# l$ A: Z7 f
1 \8 J6 m0 q. d9 t7 R& Iend if
* e. r( B4 n% r5 G; |& A
" O9 U) g0 T5 L7 R% D% b# Bsdcms.setsession "adminid",adminid
. Q* {4 [( [! O0 I7 X) n
; V# f( d) @: n' n9 j; J N2 Xsdcms.setsession "adminname",adminname
' t5 {$ l9 H6 B' M6 ~. U G ! e# z$ F7 J) G+ R# s
sdcms.setsession "admingroupid",data(4,0), s/ h! A8 U. n$ a6 `6 I
% f& d6 ]) C0 O0 {" \9 P
end if
/ g% @% s9 M+ V! A6 d; ^7 X6 [
: E! d7 D$ s. E0 f, |9 Rend if( m; ^: `# R9 g7 |9 J
- o" F2 b! z* J* }5 E# u
end if/ o' w H6 |2 U" M+ w. R
7 R3 `$ q+ v8 W( F- i/ G/ w
else1 a! U3 v5 T/ J1 j) F
1 R; I& l ~6 \( zdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")3 {: a, V3 ^6 y2 @+ t/ T
, _2 u5 C& P; s7 E1 i
if ubound(data)<0 then- }' r% a6 o! u! f
0 M n$ F F$ ^5 c% R* X' vsdcms.go "login.asp?act=out"+ M/ Z, R) j( M* z! d H2 Z
9 G0 n: M$ \4 _# X- }0 k% J/ X* b
exit sub3 n* i7 \" @" U# O9 V/ K) i* Z% U) K
' W- H3 ]1 z" I7 q* H+ f, o0 D) M
else
$ F# A1 }+ G5 Q
( }: ]% n, g0 E; Y# G" Cadmin_page_lever=data(0,0)
+ G) B, v( }* B6 O7 H8 ~
3 z* u7 Q4 P/ r x+ \3 {admin_cate_array=data(1,0)
' d- \) @: ?' @% j2 L+ x- f
0 @$ ~. i2 u8 K# a' C) Eadmin_cate_lever=data(2,0). g( G9 E8 [. b( L" q6 T
1 u( m: ]( i6 O7 G9 ~
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0. x) T0 p3 [# S$ I* q
# @- [0 ^' h" n( E7 y! c5 X
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0; R; T4 I* R* G4 f/ ^1 G# L& \- v3 L
9 ?) t* U0 V+ j
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0* L1 O2 r# u2 e' @% w8 i$ u
+ I$ D4 I# q. C+ l% O; H5 Hif clng(admingroupid)<>0 then% f4 k3 \: V) V. _' V
& n; g4 @, Z% \admin_lever_where=" and menuid in("&admin_page_lever&")"( H9 B/ o3 h' U0 F: j& q
7 V, h9 Z8 I/ ]1 Y$ |* g" u1 Dend if* c* W* i R. V4 @8 ]
/ y' v7 P& s7 Y, }
end if
L- r, i! j4 P Q* b - Z) w+ G! Y+ C3 b {/ G
end if" d/ K) H% B( e. a/ s
( `$ }. |, z6 J e* L3 b
end sub7 W" V6 }0 j7 Y9 w9 v5 @
漏洞证明：; `# ~& h; h+ m J0 V+ k
看看操作COOKIE的函数
- c% x/ M* \. N# Z" J6 ^$ C ) ]/ l. q) d! K: i
public function loadcookie(t0)
a& n: R7 Z5 o# Z
# g+ M( _- k. C6 G% T& f& Eloadcookie=request.cookies(prefix&t0)6 D X$ p5 m7 j" j
/ a. z* s3 p0 s' j( w
end function/ p. i( V; L' ^
- R/ E) |$ p& Wpublic sub setcookie(byval t0,byval t1)
/ A: U# \0 S/ l) E+ ~7 @
, O0 C6 [1 G7 @* i g. _2 Z8 U$ Z% aresponse.cookies(prefix&t0)=t1
2 Z l8 h6 s3 |* P$ h 1 U; q' ]3 L1 o* w: ~8 o
end sub
1 _8 w! \7 |1 R3 d% j0 F + r* k+ ?) O- x: r0 c7 U
prefix$ z; h; b& w9 p, H' B, c- X
1 ^; t1 I2 p* l' l4 d# i' T'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
, L- p7 V% V8 a, V
6 G6 q0 U2 c- g3 i* O" Tdim prefix Z3 p- G7 f" m: H6 F" `# @. _
3 d; A8 @! B1 a" ]. ]prefix="1Jb8Ob"
- T! r6 u3 y m- ]" y) q& P% F9 @ " r3 G! e3 O* |4 L5 p" Q4 o- W3 g
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
4 J2 i8 c! k* `& |1 ?2 w
5 D; s6 A" L3 D/ l8 x% |3 ssub out
+ x$ K0 a; h) N 4 \+ \$ K/ ]8 T" v: q, L
sdcms.setsession "adminid",""( p2 M3 o$ a( o* K9 Y2 w. ?0 b
4 e! A8 Q( v, c/ ?# Z
sdcms.setsession "adminname",""
2 q# O$ o! E: N; P7 F* ^ 9 w' R% B$ m N& |2 ]2 V
sdcms.setsession "admingroupid",""
3 g9 `; t* _0 ^( Z2 m, x2 l
1 Z) y2 u* ]5 p: @7 Esdcms.setcookie "adminid",""
% O* c" d) Z6 L( y * b8 i3 v( M$ Q1 s6 ~' a$ X% y. I
sdcms.setcookie "loginkey",""; J7 @! N2 B2 h, {6 _1 `8 ]+ T
- H$ {) I7 \8 B' r8 q* p$ H+ Z
sdcms.setcookie "islogin",""7 ^1 c- `! G5 \4 r, T0 }# o2 _9 J9 K
- |# F% f& i& rsdcms.go "login.asp"
; f3 d6 q( T% Y& T' O) z - J3 i0 K) S8 m: m& T0 d6 v6 t5 `
end sub: z: j- Q9 s8 Q7 d6 Z
! f# P/ N/ w: I6 k/ a1 W. w5 F
1 s3 c9 {9 G/ S2 f) T- N) J0 W利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
4 ?6 O9 F" Y0 A; o$ ^# E$ b修复方案：* y% Y4 N8 W# N
修改函数！ g" \5 M+ W- h& T* D& @- @/ f( a
|
发表于 2013-7-26 12:42:43
收藏
支持
反对