要描述：. {$ }4 X- f) l% C" j9 u# a$ g
+ Q, h% `, R9 p
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
. j3 v$ P7 ^* d% u' @" z F详细说明：: K& R6 y) L/ o0 D! ~6 N
Islogin //判断登录的方法
8 O# o" e* \' ~* p* b9 |& b& {
# s0 b( m/ v$ N E! Y3 vsub islogin()
5 w) s$ q4 Y* K, B
C3 r4 R% N7 T* h$ \if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then 4 \1 W ~! J! d( \! o# A
- S$ b5 J" I$ ~# mdim t0,t1,t2 $ n; L% e- `' r/ p
3 w. w9 Q. x; ]6 C
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie # f F% _2 Q( S9 V
, |% f7 `7 _" v4 s4 d8 E
t1=sdcms.loadcookie("islogin")- f/ I) @6 o, E# t% g# B
; p/ e+ L* n2 y, x# k# \" j- ]0 J
t2=sdcms.loadcookie("loginkey")# h; n5 R6 G# l, C
. N* _8 \* s) ^if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行2 L% Y3 o' e L9 Q' R% t- W' a
5 T" g! }# I- m5 N1 d//
- L! H6 U5 h2 ] 5 C e- _9 w4 ^( C ?( z
sdcms.go "login.asp?act=out" n% G- Q; O* ], y A$ S
+ F, ^( L1 p3 K8 S6 y+ y! n
exit sub
! B2 p: d9 |: F3 a" G0 o 8 i2 f: k1 @, L; w
else; A8 w/ u, h9 V
9 D/ l6 @9 e* v* ]; V% G2 }0 n& q9 C5 [dim data
/ Z# _- h3 |7 @ ) M+ G8 l( f; b8 B" ~- k+ N
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控* v! I% J8 g+ z2 `
/ M; a/ n$ m; z
if ubound(data)<0 then
4 t, b* h5 f* p2 [: t& s
% n5 B1 Q5 L* e4 s, `) Y* j: _9 g" Psdcms.go "login.asp?act=out"# L& u/ J p5 t: G0 I, W- X
8 V" T/ a) ^0 W* V: q" X% S
exit sub$ F: m* D$ a" y+ Q8 J8 v$ w
# u* t' s) s3 e3 K% V+ x8 }6 z
else
' v4 w+ [% u& ~
( R, Q, B% o" k3 s/ [1 bif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then/ x6 J+ p( V" O, m* i9 K9 W
& k6 y; g# I$ w/ ^" D! u, f
sdcms.go "login.asp?act=out"
+ b; a+ K3 G" t+ t- S) b+ t" k
4 {& J/ f# ?5 Z+ t0 u3 nexit sub
" H5 l4 ]# j& P* D
, q0 q/ S, F7 j d5 c, W p0 ?else% c; u2 }) [& e) g( l
/ I8 Y" S2 }, Zadminid=data(0,0)
% L. {6 Q9 E5 k' y7 E2 t
b4 E$ x& @& N3 Wadminname=data(1,0)# x% `% ^: E% F% p3 \! N" E4 k
/ \/ l8 }. h& a. Uadmin_page_lever=data(5,0)
& I+ C- P+ @5 k4 {$ ]+ t9 g ; |# _% I9 |/ N$ u6 `" t g
admin_cate_array=data(6,0)/ f; S) {/ D4 q+ d
/ o+ q+ i8 k0 C7 D) u9 B' [admin_cate_lever=data(7,0)
0 X3 g1 I( `+ W8 O- v. B
! `# Z$ k; B, V4 U6 Yif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0 K% ?+ R5 A5 V: M
. W& k5 X8 {/ f. x9 b; Kif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
+ p, ]4 w' Z( g: G& A, | {
5 l/ A0 h8 U( qif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0) Q% z# p4 [* S8 b! K! Z
0 D% ^. v* I U- f% x8 ~" J( y* N
if clng(admingroupid)<>0 then6 U/ Z4 h2 C' ]& y# p
) Y+ J9 W |) _3 b" r4 [& c
admin_lever_where=" and menuid in("&admin_page_lever&")". ^" q7 H9 j+ E3 {7 q. B. U
& W+ l' ~: ` f4 Y! aend if6 D0 |! P6 S4 ?) y
2 A8 b. b' p! b, Qsdcms.setsession "adminid",adminid! w* H: M" V/ `0 Y3 w% w6 G
$ O8 I, S: o2 j B7 f* dsdcms.setsession "adminname",adminname
% W& G" @, i) D, Y* D7 p8 Z! r/ a 8 k( y# |- g2 @4 R! @
sdcms.setsession "admingroupid",data(4,0): A; l8 n7 k/ D! H% x5 |
4 K1 B7 N7 B7 [
end if
; q# s4 t/ c( @- x4 _! w" U 0 G) s" ]7 H! V$ Z% \
end if5 R3 b, Y7 _+ _* n5 } H
5 Y7 c, g# |; ^0 D6 t7 M
end if/ A. S* _! p. t/ u
4 J: E5 Q) c/ Z9 ]
else8 p& q$ O e- x* P' l5 a2 ?' D
1 {0 k" w: G7 P$ h
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
; n: d1 ~ c7 i' u 7 l- v* {. A) q1 R; ^0 E
if ubound(data)<0 then) t7 A$ k" _. _% [' ~" w" ^5 `4 Q
) L2 H8 p' a) m- _- Lsdcms.go "login.asp?act=out"7 w' K# }# d/ H4 X
" b8 \% d4 l8 w+ r0 E8 S* c4 Rexit sub
+ P% N- b: A; _6 e/ @ 2 ~8 l9 D, ?" u- w2 D
else
6 q# [0 p9 h3 j: I, n % ^2 I' w' R3 X# `$ i/ W A) W
admin_page_lever=data(0,0). d1 F% m! c6 R' [
0 x# x6 |# q( x: x
admin_cate_array=data(1,0)
) x) E- ]5 j) ?4 g , o* u5 K0 m3 M- f3 b
admin_cate_lever=data(2,0)7 j$ R8 H" Z# }7 u t, ~
/ E" D3 E% ?+ g6 @5 v( q3 \
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=03 P7 j7 N: q$ s8 E0 x5 F* F5 |& d2 |1 \
3 `/ c- @" `8 R: q' c! j/ s; fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
" O% h* a1 J' ]4 { |/ N1 @3 k 1 {" \! O$ u+ X! r
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=00 j' g9 }8 R. t. E% _% _3 I$ {
' _6 ?7 g- D' L; W9 ]if clng(admingroupid)<>0 then' |$ A0 d8 d7 B
3 Z& ?$ A! S# q4 r+ P8 N+ z; W
admin_lever_where=" and menuid in("&admin_page_lever&")"
+ E+ c' T# h8 R" g5 G
1 g5 w: U1 J0 K8 C5 S, H8 B+ eend if2 t }) f$ Q4 Z* z( ]
) o+ }7 G: b0 M( xend if6 \$ \$ ^) `9 f% E1 |: Q
" r6 K7 N+ H% x6 Iend if
0 l- |' ?( i& N0 p- h9 V$ a * c! W) f, W5 Q- e( p' c
end sub2 P0 H% P: a( h. R! C A% g. ]2 Q) A
漏洞证明：8 L% ]/ j+ z- Q! k1 ?$ ~
看看操作COOKIE的函数/ F3 O* K% Q4 Q( U
' d# p1 h& {1 Y8 W, u7 hpublic function loadcookie(t0)
1 e+ x; B$ ]2 r1 T/ i8 X ( |/ c8 ]* i: |+ W" I7 @7 D& G4 D4 b8 }
loadcookie=request.cookies(prefix&t0): C. B$ ?0 f1 x% K
! ]) ?/ U$ B a9 [1 ?( _8 U6 Wend function) O" S: e7 C" n! q' j/ R
6 j% A" z7 v% T$ spublic sub setcookie(byval t0,byval t1)% D4 z5 Z9 Q; T3 c4 {9 X4 O
% M* F" |4 a3 e
response.cookies(prefix&t0)=t1
7 a5 U+ ~0 B% s( L
J' O9 k7 ^$ y) i( C( A- d, j. dend sub
" m- o% K8 S& I, v ^ / Q% B+ o6 r7 C5 [* Q
prefix: N9 Z, i$ \# B7 O" L
5 L2 q" |; p* j( a$ N. g
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
8 v, T' G6 O( x8 j" m # b4 u% J3 Z" Q3 K3 l( b$ Z
dim prefix
( u3 G0 [2 R) q3 M" g
& H/ W7 [; S# s; ~/ m. r8 cprefix="1Jb8Ob"+ V9 o$ Q$ `, W4 p
+ l9 g7 K- B$ X& C) ]/ ^'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
% G; J; D; f& Y0 ?% Y! G5 w6 _ & E$ W( w4 o' D
sub out
& N" Q9 r" t% m7 Z % e+ n* q, \( s7 f/ I }
sdcms.setsession "adminid",""/ G0 Y" E6 [! V' v/ W( _2 g: {
, X; v `8 _7 `4 _# v4 psdcms.setsession "adminname",""
0 f w% ?% O+ d4 z" m3 `
( c; C1 s! `5 R, n4 N/ ^sdcms.setsession "admingroupid",""
. t: t9 @) }! C; R5 @' A7 E G
+ s9 @. {4 x. {) G1 X: W" d3 lsdcms.setcookie "adminid",""
4 u8 i! N- j9 n8 m6 F8 q* L6 L% ~ ; m. q* D6 G0 u. ?
sdcms.setcookie "loginkey",""5 R$ f6 i) i9 g' B6 H" k8 U0 Z; q- l. N
9 a9 ~% F- l( d7 j/ Qsdcms.setcookie "islogin",""
- \ d, r y0 U9 R# A$ H( S
$ O8 A6 E$ D& q% [sdcms.go "login.asp"
0 _& p/ i- a( a i: D- k+ v) W 2 e1 y* q+ ~) I1 c$ [& K
end sub
% e5 c, Z% w- G [$ \" u/ x# I
0 c! |* h5 I" `; Z6 Q2 D0 W$ L ) F% Q! r, Y2 i/ z* w4 @
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！9 s1 K- q% y) c# {
修复方案：
8 S( u5 Y" `/ ~- D修改函数！/ p' ~3 d2 x/ u* x5 M
|
发表于 2013-7-26 12:42:43
收藏
支持
反对