要描述：' U3 \% ^" g8 \2 F% x
5 y9 E7 d% F; e: M# O' V- ISDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
: l! a" v7 q% U6 I详细说明：. l. N) x0 \, ]4 h- r7 E
Islogin //判断登录的方法
! s" y- i& s% ^& l& ]! r. a9 p 2 d; \ \. p; L7 P6 T$ A
sub islogin(); t5 d) a2 _, i: b2 P
/ [$ p/ z+ J/ z6 ~& X( R. O
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
, i( B* n$ K/ e# [# p9 P, [ J1 i
+ G' z, e0 K# ^dim t0,t1,t2 N( K+ s9 W# t: u
9 B+ T0 M. N2 |. z) s' I4 {
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie $ |6 ^8 k2 _& ~) ]& w! d$ x% g
' c4 {0 s6 @9 w% O1 C! f4 e7 f
t1=sdcms.loadcookie("islogin")/ s2 w B Y. G" \; F e6 x W4 p
& Y. ~2 V5 n: H; z: g& Q
t2=sdcms.loadcookie("loginkey")
! W: f7 Q- S/ Y8 D% @& ]& v
# X; t* G; T h) `6 u# s: Aif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
2 E# S. z4 N) }- l" _
- K+ {( r; P5 X$ c$ s# s4 G//
( u8 G6 U8 P- J4 [2 P& y$ d& s : r/ J9 |. s% `3 x L: K! ]
sdcms.go "login.asp?act=out"
: ]0 N4 \6 ]3 I9 ` ) N& x+ b4 z. t3 y/ n9 z5 `7 ~
exit sub6 d5 ]: Z# N1 W5 p1 c! }
3 ~4 J1 d2 z7 }6 q
else
4 I" l$ n. ~( J: K# C9 L ) d7 L+ ]. I2 k& q3 {+ u+ y
dim data
$ r# V- G2 J5 z; j) N, S2 h
9 t0 O+ X$ {$ S6 p) k, q Xdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
8 V: Z$ G+ W: U% p8 ]
& O2 T6 ?; b) x; a/ rif ubound(data)<0 then$ L- Z q2 ~' N8 F
& K F' R' |+ P5 hsdcms.go "login.asp?act=out"& b) {; J7 o& F# Q
" L' L/ R9 V8 V: G
exit sub+ }* S6 M& g) `6 L
7 N/ n' o' q+ e4 r2 m* [else+ o- L+ h8 E5 B# Z
" E7 o+ F: P9 g1 R/ zif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then0 y3 C/ d- I: g
* w) C6 y( u1 A4 H- b4 L4 @sdcms.go "login.asp?act=out"
# ?$ p4 Y* l. X8 ^" J6 V5 i 3 i9 K9 n9 l6 O2 f6 o+ q
exit sub4 r* s6 G2 r8 b' j, _1 k) J/ U0 O
) @8 P; ]8 R$ \& j6 b
else& ?$ k5 y+ f& x$ z2 s d
( F$ X6 y% R6 v! }' U$ Fadminid=data(0,0)
& B! s- `. M& m7 l S4 @
8 y! Q i0 q- `0 e3 U' iadminname=data(1,0)
# }. j9 C' B3 C5 H! T1 a
4 B' ]) U* K* y) x/ ~4 v1 Radmin_page_lever=data(5,0)# r; D. O: P# p$ B' d! o M4 Z2 K
9 B8 a3 l' O. l B" d8 x6 i2 E
admin_cate_array=data(6,0)
0 N! w2 U& X& S! ^
3 |9 K) o8 v5 m4 K- b. I0 cadmin_cate_lever=data(7,0)! L+ L3 w; h# e; l
) J& p0 Y0 ^8 o: E* k3 ?* {& _if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0: r! c8 b# y4 F) n6 M/ Y$ B: d
; |) x. i, ?$ S; ~' ]if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
- E* o, N& x) Q+ W5 k+ F8 [ - \2 V- U! v; o' o# F5 h
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0# H1 u) Q! V1 L/ j, g! m; n, {6 I
H$ `) z. a$ m# S: o
if clng(admingroupid)<>0 then
9 F: B0 c2 p1 Z: w3 |# B' Z $ G% n- h( r8 i' I, E
admin_lever_where=" and menuid in("&admin_page_lever&")"& r: Y! h& s$ l3 V
) q% f: M! F/ A1 H9 T% h" C* z* d C
end if
6 m" ]2 W' \* C* c$ k9 d, I7 g& ~ $ o' w4 K3 s7 Z8 b- J
sdcms.setsession "adminid",adminid
7 j& M4 \9 ~% I ) e( R6 Q+ G/ P/ v$ L7 R% y( K
sdcms.setsession "adminname",adminname
1 W! W% _: x3 W) _
8 G3 z, b8 Z* K; }. usdcms.setsession "admingroupid",data(4,0)' O' V# R7 B# ~/ t2 |: f9 @
& b# m! A5 ]0 i. A7 ]end if0 u6 M& S3 C! O
V) [5 \+ A& s6 n; s8 U9 L6 u
end if
" Y. J9 p3 v: d. e & z) e5 S: [! T" F; h& s" i. K
end if
~) B: _* _8 b3 i# a
' M1 `& y5 W Z3 c3 B9 [* b nelse4 w4 A e+ F# E
! r! ~2 c6 `, {+ j2 fdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")1 W: C; F6 V1 d9 c9 b
. }9 T+ P& g8 c$ a$ P
if ubound(data)<0 then
0 Q2 }0 U2 O' J, d9 [ ; B% ~9 X2 K/ J) w b. r
sdcms.go "login.asp?act=out"6 K: x- {0 G7 D/ `% j$ e% U
/ t3 P, D$ q& p4 x7 kexit sub
5 F- U: f- R1 I, v) U# w/ \
( R, I1 G9 I6 V3 V( G6 H. Belse# w3 q/ g) T' C. m; D1 @2 O
: P a9 `9 x ?4 {# }
admin_page_lever=data(0,0)3 X& Q- f v( W7 x4 t( ?, B- ~
/ d% S( u' A5 o8 nadmin_cate_array=data(1,0)
. {- G$ C% y, A
) y( l7 K: q* a; ?/ Aadmin_cate_lever=data(2,0)
! y7 I; z0 Y% A# { $ g! E1 P2 F3 K! \
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
7 {* h: p( w2 P+ Z9 N+ V7 x0 b & i. a0 W% U* \5 r
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
( j1 M1 x- R! P$ P+ {, {6 r
6 z% _2 u- r# j0 @+ ?if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
. Z" G* g2 x* k* ~1 z S1 t
" ?' v: m6 ` @$ R3 lif clng(admingroupid)<>0 then. y, x: C8 [, r: L( z( A
' j! f5 L! j6 x b/ d/ l6 r
admin_lever_where=" and menuid in("&admin_page_lever&")"
( F* q- e0 V: n) F$ b7 K' j
' N. [7 }% |- q1 z# eend if# i* H/ K" M# X H
t% z& k, }+ ?* }end if
$ B1 l4 i# q7 D- h* p" ~% J # G2 Z) P3 n" o+ `% ^0 }
end if* n1 z( T1 v% M9 d" A
$ R. Y8 d6 g( Z( L& \) T+ o5 Rend sub
, ~# v3 r' f" P* t6 \/ i漏洞证明：
: Y; H/ Y. Q3 ^" \) k5 N( j, L$ |看看操作COOKIE的函数
! b: q! T$ k+ l4 m" o) e ! w e' f/ B( \+ E
public function loadcookie(t0)6 c( b" c0 |( x* K$ w6 j
; }, }5 \2 T( N* ^
loadcookie=request.cookies(prefix&t0)
; ^6 r( d, r" g- B 8 @9 F+ {6 O$ l3 T
end function
- S2 A9 E) {/ B' O ' i9 i% V8 y' Z2 r8 L$ j" o5 w
public sub setcookie(byval t0,byval t1)! u3 ~* t6 f; n f
1 h+ n0 V: N5 p. H/ Q" O. t
response.cookies(prefix&t0)=t15 Z; r9 U- b$ H; Y; c
7 B/ @! h% Q* S( E fend sub4 `6 f' r& R) f. B: A
+ p) g! o, o) \4 y+ N; E+ `prefix% g8 h8 |, z' H
* F0 Q& S7 j0 f& }; ^'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值5 `0 L4 w' z2 m' H
3 h8 u. l( y0 r& d2 ]+ ndim prefix
; @/ c; N9 r( {/ [! j5 c - Z! J0 U2 |. ^
prefix="1Jb8Ob"
X0 F @/ U5 S) ~% D! [ ' g/ w9 J! I+ E, H+ c6 R
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
8 E6 | A( ? l& k% o7 Q/ _) B' E
) G: K4 _! m& G u, P- }sub out9 Q% X7 A9 Y0 r2 O3 C5 W( U" w
* g E' V/ l: W9 n8 bsdcms.setsession "adminid",""
9 U* p8 |: ?2 M' ]7 E8 h J* t
* G& O- x8 z8 ?" }8 Fsdcms.setsession "adminname",""
# Y' p; W) p2 h% g% T9 L- y& z/ Q 3 K* \' m" v, x. N) r3 O+ T
sdcms.setsession "admingroupid",""
+ V; L3 f% ^% G" h0 o
! g. M7 V' l& \sdcms.setcookie "adminid",""
2 P; P O' x9 P) n" E
$ q% g/ V- Y+ B+ U" w, y5 F' F9 isdcms.setcookie "loginkey",""& y3 S2 Y' n g$ ^4 r
: b+ C$ n2 c0 \ _6 G. asdcms.setcookie "islogin",""
2 l/ r/ d- d7 C
6 w" F+ B7 X# m& r* {sdcms.go "login.asp"% S. k( j6 c. c* \: E% P
5 W8 n7 [2 E" v. M( mend sub+ i7 S) Y: V- |7 w; N, W
) K2 |8 u% R! X5 o * p" t5 _: d9 ^0 g$ J9 |5 g
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！ G( z) {2 t9 `; `
修复方案：9 s* G) |" \/ u z
修改函数！4 `7 _/ J7 ^) ?/ ]: b# J2 M
|
发表于 2013-7-26 12:42:43
收藏
支持
反对