要描述：
, N" K) T: |( X1 k( h) B
; s7 e0 t4 M# v& l" k5 ]9 A8 vSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
7 ?) X2 i! e1 E; c& \1 @3 a详细说明：
. u3 j/ E* w W; |6 v1 r: C g# iIslogin //判断登录的方法- G. ^8 ^" f2 j: G% D2 w+ n4 t3 ?4 T2 N
u" ^; t2 e. {8 \2 ^) Osub islogin()6 M) i$ D- x, u2 E! X$ m9 U8 w
9 S9 {) U! i+ m+ m
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
! W5 Q' a+ t! D& S0 u, L , L5 Q' ]1 h; s% V R5 R
dim t0,t1,t2 1 b: r# i2 t8 W! n" `
! t1 k5 [4 b& t+ H' _7 H5 J
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie 6 V1 b( T+ @% H6 y5 l9 U
% o4 i a# f- z( _/ z) \0 c, `0 f, Vt1=sdcms.loadcookie("islogin")
0 `7 Z, s o/ }( v7 _! A' y" n# v ) |* `3 h1 D5 d9 ]! }6 c8 W
t2=sdcms.loadcookie("loginkey")7 o2 L7 U/ V7 l* X2 X
( x/ X; X" ?) l# P9 S! O F$ e
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行. m3 u- V# g! l O w5 ~
! f( v; s5 w, H( y4 ^2 T/ i( @# F
//0 g' h3 }/ n$ ~" d2 F$ ]; O" E
. z |- v& y& i6 {$ `sdcms.go "login.asp?act=out") I) c' a0 p$ h4 @. t$ N
- D3 L% s$ c7 D
exit sub
( @* X! R" ]2 N4 C, R7 \- R
2 q; `4 x" n9 U( C velse: a: V) I4 W- X/ |; M5 K" j
, p) h1 r2 I1 h$ F; wdim data
* V4 P4 L% `4 ], ]+ h, d
4 B/ `1 Z9 w7 |data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
: k. O* [, v" z( q' F: V! J0 z$ y 1 D& F( T0 R, b
if ubound(data)<0 then
0 F) y* f/ }& j& u# L. B# v0 Y
- c: y; g3 W( r5 }. L) G, l+ Esdcms.go "login.asp?act=out"+ U, r) B" x1 f* a: D5 h$ B
/ ~. C1 x$ W1 g4 }7 q
exit sub
- I U9 P+ b& R- ^* @5 a $ t" ~) B2 ~3 _& [6 r
else8 S) h. H! w( y% S0 ]: L/ h" V
( Y1 @# L& a" hif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then0 C3 Z D+ q: C* o/ U: @
0 n% w: @4 Y: d9 osdcms.go "login.asp?act=out"
/ K0 H2 H1 B! i& Y9 o! O
; `. Q; A& R/ z# h1 d* M5 gexit sub
- z9 L1 E U K9 `' v+ G 1 W) c- o5 s' @3 U: ]
else9 w0 L3 }' ^9 B) C
" @5 L' ?4 j; ~3 O
adminid=data(0,0)
) j {2 h5 K5 {1 G * \2 K% T; _- z
adminname=data(1,0)# P# G+ `' L# m; o' @2 W( q
& z/ ^2 H1 Q) f% \; L2 }0 K
admin_page_lever=data(5,0)
1 O" P5 y+ j! n* p, F( N% [- ^% G/ D
' D8 o4 ~' `& h) [% K1 Xadmin_cate_array=data(6,0)2 g* }% `3 h7 D. |: N7 [3 p& ]
! T6 M2 i% W& q2 Badmin_cate_lever=data(7,0)9 x6 W! U8 b, W$ B5 O, f
3 w2 `# n" a C# K) K
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
" `; J3 E! i1 ?0 K- N8 L! } - W4 T2 T& v% I: F2 G3 |
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=08 f1 I/ [# v' ?3 M
$ ?5 ^2 ?# e/ V4 r# g
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0+ X" P$ h4 ~' r8 }" ~( E
( d: |3 M% n! r: W
if clng(admingroupid)<>0 then6 U- ~* _( C/ F0 ]
) F5 n, a9 P$ J# Cadmin_lever_where=" and menuid in("&admin_page_lever&")"; ?0 x# A& C: W, t1 r" O
; m7 }- \; Z+ f0 N, _" gend if
2 L* h5 U: i- L+ n/ {' L; A
1 K) b- ^' [, e, A3 Osdcms.setsession "adminid",adminid
o" Y" b4 g: z j. a8 ^* @4 B, T6 m/ H 0 F0 W- `# y/ D( I5 h" s
sdcms.setsession "adminname",adminname& Y! ~8 D; n$ p$ M$ x! }
! A F! J, o9 ]. w6 wsdcms.setsession "admingroupid",data(4,0)
- \& h2 M1 S; p _# s $ h; P4 l8 T* ~
end if
# j( `" L. s8 z _( ~
+ `: s Y, q6 {end if$ a4 y9 u( v* v5 L0 l
) ?" `. c& n# D; K R" C' C# c& w# G: K( Nend if( m$ x" b! T6 V M
( C2 K/ M* @9 U; r' A* b# x' \6 x3 F
else
6 Y( \ b7 |7 e( k
( V' a, ]) O h7 h% s3 ]9 Udata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")+ l5 F: Z5 w( |4 E$ j2 J4 W
4 w$ z4 l$ G) n Z
if ubound(data)<0 then8 w1 n) C! G6 ]/ k
- x* Z/ q# W) u6 ?3 I
sdcms.go "login.asp?act=out"
% A9 o+ U, I; p9 _7 }- Y1 ~9 K
" i# v, B, J) `6 u! _: Jexit sub
- }: s8 q" h1 X8 H' X( N5 ^
+ Q- v- [, H/ b+ ?else
7 d! N2 R) G0 M" X, U
- O5 f4 T! Y% L5 }7 Xadmin_page_lever=data(0,0)/ B. j+ [/ z! q. H# n
7 W5 P. x/ N2 m" k/ U( m
admin_cate_array=data(1,0); _6 Z4 ]* ]1 S7 J8 R
7 T* T( Z A w3 J" @/ e
admin_cate_lever=data(2,0)
9 I7 X; J( h9 |9 \5 X
) y* U1 G5 n/ b- Dif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ [& k/ i7 u5 A 9 U- Y8 j( r) p- z
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=06 c( Z6 u0 q* P. U+ U, e
) ]" t7 r4 y. ]$ u" M4 l5 n& ]
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=07 q' J! {4 ^) k# ?
p( b' ~3 a1 a! v
if clng(admingroupid)<>0 then
- D( Y" V; l+ ~4 C# j 4 N) F; @( C& q: M
admin_lever_where=" and menuid in("&admin_page_lever&")"
( |$ w+ Y5 g/ G1 V 5 k; P P+ M/ H! ~
end if
+ y4 b5 q2 ], e7 W x9 S( I9 {( c
! Q9 C4 I( s3 [- }& ^* _end if- b- s* a' P1 L
( J: A3 S R' P# ~) K6 a! Z! s6 bend if
0 G* n6 @3 u2 j5 e8 q
: ]0 a/ Z2 f# E6 Nend sub& S- G2 l* i- v. t
漏洞证明：
2 E$ H+ o1 d. a2 x看看操作COOKIE的函数9 w4 r8 V$ f8 X! }. @# m
, S, @4 J' K% Q" X& |' n' i& h- w! `public function loadcookie(t0)
# w' ~/ d8 b; E5 z, ]& A
% q0 }2 u! P6 I, p4 Wloadcookie=request.cookies(prefix&t0)6 o" U( {8 s( r+ g) ^1 U
9 V% M$ T* r& `: s- [' [. h
end function
6 E, A3 e1 [6 _" ?) m+ `2 p; N
) C7 ~5 }6 ~4 x& t) o/ | @public sub setcookie(byval t0,byval t1)
) }1 ?( i1 g$ g6 w' r& [
5 ]1 P7 |' U: b+ C) ?response.cookies(prefix&t0)=t15 p4 \4 E' T: P# j4 R0 @
5 j4 [1 {3 [9 o3 L- c8 G
end sub
4 S$ m' Z! S( c5 n9 I; i # R1 l, [, s5 a) S6 E
prefix
0 t; U' U% k L: [% _ # e/ L4 A% S* \" g6 P
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
% k' i. w& @' ]6 c V2 Y " F3 z/ h, \( i" l6 O( B* [
dim prefix2 }* j5 [. K8 `1 q. y! v
5 P. a* a2 m& [% L/ u v) q! Aprefix="1Jb8Ob"5 K! K2 Y4 a" U6 q! a$ u
% T! R T5 b+ \7 y7 `5 i/ Y
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
5 Z8 [# T7 k0 q/ B# _ }5 u0 v) w* B5 f
sub out
# N" v$ J7 V) h/ T , x# l5 i2 E5 l, f
sdcms.setsession "adminid",""# N! `( U* P/ f. @/ W
$ B& n0 O5 @: t6 l! R
sdcms.setsession "adminname","" J9 Y/ e- r. D8 ^
* }+ ]% g. M7 n
sdcms.setsession "admingroupid",""* N# `9 U% y! Y; A5 E# k7 x
: t' m: ~; I. z: _sdcms.setcookie "adminid",""
3 Q# v5 N# V& ~2 U" z3 C
: J( ?- x' U) j8 H( rsdcms.setcookie "loginkey",""
4 r6 J$ ?0 k& Q8 z
2 b3 n- a+ J( }( X; ^. osdcms.setcookie "islogin",""
0 K6 g+ Y4 m) ]2 ^ 4 C% I, q9 `5 _1 T7 M- n7 U7 s, k
sdcms.go "login.asp"/ ~: N# d. O5 c4 N7 F
" \: X9 y8 g8 {. ?end sub
1 S, j* C! v, W% B6 P* `; D4 K! d
7 i* V% ^9 T6 F9 a4 `8 A ( J/ R/ I6 y8 v$ Q `3 Y; l% m
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
( `( d t4 |" K0 M S, ?修复方案：
& e0 D9 ~" A7 t+ ^# G) A2 n修改函数！$ \+ g7 b: h- l4 s* Z. J
|
发表于 2013-7-26 12:42:43
收藏
支持
反对