要描述：* A, Q( x- b! e8 t* o
, H) u* }* b7 y9 hSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
5 U7 p# o& I: \) G9 k, B8 F5 U! b详细说明：
( a V$ r Z; d/ EIslogin //判断登录的方法
N" S3 G" _3 z6 a- M3 @ 0 c9 c) e( u9 h' F2 B3 p0 \
sub islogin()+ e% t( r$ L, s+ W- a3 ~
' D$ I9 h4 S% ^7 a4 @if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
( l) @9 B0 m! Z0 z : D9 z: A' s; W' `6 `
dim t0,t1,t2
/ k% \3 ^, O( `: k' r; C& J
( N1 H: Z3 O, c: Lt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie . Z( ]! `; L7 X( G
% ^+ \1 L8 m* K7 r3 k
t1=sdcms.loadcookie("islogin")
! a0 s! d8 n, g) ?
0 C% G2 l' d$ ^t2=sdcms.loadcookie("loginkey")# I# z6 ~: ^; y5 d' X+ L. r
, S4 P* U$ s4 x ^4 n& Z
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
; x- v4 w' U! b# w4 ~& v- L
' {3 N% s% O! T! f k; I; B% T//, Q" U: X2 x) [6 o/ B. Y
K C/ M4 ]2 J. C/ W/ q5 U
sdcms.go "login.asp?act=out"# A! t. { o1 Z8 Z8 I+ V% w4 W
: {0 u: c4 X3 z/ `3 Y* k
exit sub; k; w3 K3 [% y
' E6 W5 x, l3 A X7 v, Relse
) s+ B2 L4 f9 d$ o' W+ H4 z* Z0 B 1 O3 s+ \- s/ Z2 v, f
dim data$ @+ G7 l+ V" k" [ }5 ~
8 x) w% O" I* J8 B9 Y1 |
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
5 T. Q( P& Q3 g$ B) ^* r 8 m8 T" m' p8 M0 \! z" U
if ubound(data)<0 then, L' l ~& w* f6 ^- t% ^% R
! u R0 |- Q, C8 Z* F
sdcms.go "login.asp?act=out"6 b: C- G! U& ]# _6 @
5 |( h: F3 k$ k# U+ |# `( bexit sub
8 {+ c/ O0 a9 O" i
/ z4 U) o; z# g, m8 a; d3 X( [else; q9 u0 n* i8 U( S. Z, k) V8 R
, `! o4 j& S8 Y
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
/ s& r6 v6 F1 }5 [; }% T1 m; y: w
5 g+ M( c( ~) M" t5 {sdcms.go "login.asp?act=out" @0 E; Q( S9 b9 a4 I0 I) r4 z
; o4 B% @$ H' g6 x
exit sub
/ U7 o/ w' V# Z U2 v $ o' J: _( n; q6 s" v* Y/ E
else
1 ]: ?) ?+ d* b3 {
# X5 T" U. g! |adminid=data(0,0)
$ F e1 H6 m# e# ]& w& [$ c$ ^
; d/ S* v0 }, |4 p; Oadminname=data(1,0) J, L6 W2 r% z5 I7 A
' }4 Y- D! K2 e% `0 l
admin_page_lever=data(5,0)
9 u3 J% G- v% a$ q* k1 r, x
" p% M5 j9 H9 o5 v% b( Q. t" v' Ladmin_cate_array=data(6,0)
2 B- ^4 W8 Q) S, z7 ] [9 ~$ ^; i' }& g$ a
admin_cate_lever=data(7,0)
4 c p8 c5 I5 S5 v ! q0 F+ H- L# T, z( W0 m, A
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
0 ^5 j0 k9 G3 i# d; {+ F1 `% W
( T+ J2 P8 E, ]2 ?1 \5 Hif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0& ^: ?0 A( _' D' |' v
) f5 y- |- f' [
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=03 Z' S2 Z1 N- c; e
( w7 c( ^2 p( h& { y* U
if clng(admingroupid)<>0 then
) ]* M/ W! Q$ e) u% C! g4 e9 p - p, q+ @7 `! x
admin_lever_where=" and menuid in("&admin_page_lever&")"' t9 F) H0 C+ ]+ M( W: p/ U2 ~% l
& b; t% d$ _9 n/ Q* `
end if
9 f5 h2 J" d1 a : B; M7 K) y- J6 X; V# K2 \
sdcms.setsession "adminid",adminid( K$ v+ C7 T8 ~( B$ m9 x
6 A1 e' v, j- p) e2 @sdcms.setsession "adminname",adminname
) t9 }0 E2 J$ [& @# b
$ g( r: T% u) ~: _+ Psdcms.setsession "admingroupid",data(4,0)
* X( B( f& O8 Y. M! S% h, u8 _ + o8 n% f1 J) |* A- D$ Y
end if
; O; Y" q) @' R3 P( q6 Q p1 l
9 j* M+ \7 m' Q* U$ d0 Iend if8 K0 ?) ]* I" @3 Q7 D0 w
- v0 X- C0 K' ]' Iend if
% Q* {4 M! i8 _( M0 ?- m : Y8 _7 A+ f- P
else
4 L, E$ E+ ?+ |, e1 a3 \ # P% m c; w! K% |% K; P
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
/ Z0 c' b8 \& Y Q( Z, k& O! W 5 B' O7 \" T, g& ^7 k8 ]
if ubound(data)<0 then7 H2 r5 _6 S" A# d v" U9 N* i- w
' Z( a+ m+ v9 A c
sdcms.go "login.asp?act=out"
5 J2 L1 U2 R" M1 \4 A+ Z& _8 } # {7 @# T) f; s
exit sub H3 ]/ u! T3 l) `. |
1 ~6 |8 Y5 K5 S* P5 w9 ?else8 ]9 X& Q \9 U4 g
1 l* N% h, g& ~
admin_page_lever=data(0,0)$ I8 m: ~* L# D1 V z3 w; C
" P) F7 u$ I2 J6 Tadmin_cate_array=data(1,0)( g2 l; }8 |& X5 E' ^
$ w- ~7 E( Q6 ~1 Q! Gadmin_cate_lever=data(2,0)
- u4 t6 |5 @+ v7 _( H
- j# T' M8 m: C9 nif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0' Z6 v5 k7 T, m+ U
8 A+ l+ \! f( k7 Mif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
, z( p R B# L( a4 ]
. P. @: }# ]9 |0 C1 J4 x, fif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=09 F: [: b' B3 o) x4 E
$ v, c" D* f- |, n9 ]# F0 |$ X0 G" fif clng(admingroupid)<>0 then
1 L; v4 S; i* L& k, O- ^1 _
. S7 R7 h9 u, t1 L( n6 Eadmin_lever_where=" and menuid in("&admin_page_lever&")"
6 F3 G) }: E0 F! o2 h- v : @+ E; S" v3 ?. a
end if
' r. m9 {! ~/ \& ]/ P# N7 {
. w1 M1 x, ~: i3 D, F$ D/ Eend if
" A, G0 d3 e$ ~) _( v
" D6 ?& \' P1 d+ I. Oend if+ a3 ?& [/ Z% w
, }+ B5 z9 g' z) [& F- N0 P# A# Y
end sub8 D7 S5 b8 b2 h
漏洞证明：+ A% s! q4 d1 R ]! v* ~. f
看看操作COOKIE的函数9 K, }; L& k6 i/ r
* n6 }- v' u, H8 M9 {, H
public function loadcookie(t0)" } k- V5 ]" {2 O% P( d4 O2 `! b
4 Q* ], _2 n, u/ O) J: r2 `5 ~: H5 Jloadcookie=request.cookies(prefix&t0)/ r, O B$ h3 W
; o5 i9 W, p3 ~3 R8 b8 R! z! Pend function
# o: _9 Y" G# u0 E1 j9 K# w' h & N# m2 N. A1 |# g5 e" R8 s
public sub setcookie(byval t0,byval t1)
' T8 m& Z0 D4 K1 i/ G0 m8 W6 R/ N
4 h8 ?9 r: e Aresponse.cookies(prefix&t0)=t1
0 m+ v: a& b# m! c
1 g" s0 j ^! B' f0 cend sub
/ V5 M* D: e R, B5 v 9 P6 H7 x' y b7 g9 e$ s) `( o
prefix3 ^6 m' j& r) ]* C4 y
5 ?, B1 l# ?( m8 x* U) K3 Y/ J
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
% {8 Z' x7 `" F8 V2 m; ]
/ W5 l y4 e1 u8 u/ udim prefix- x% N1 B& \$ ^" [
2 L: f6 `" q- e, Mprefix="1Jb8Ob"
! _0 j( Z; F/ F! x% G2 f, h1 b( B
4 K6 g) L5 z2 Y6 J9 w5 j0 k'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 ) M/ ^* x3 k p7 S
, z, H# m" t d0 Isub out0 F6 ?) X6 q2 b7 p2 o- K
: ?( L+ Y, N1 @8 @) |0 y
sdcms.setsession "adminid",""
0 C8 p! o3 K( {/ A5 M
4 z9 I. \/ P0 d+ Y6 ^1 ]1 q! ]: I4 xsdcms.setsession "adminname",""' S" E) l7 l6 e& s" u% _$ ?: z6 @, S6 }
% W8 |8 ?/ I0 p" Z, u M- S0 q1 H1 ^sdcms.setsession "admingroupid",""+ N1 }$ }6 G8 N& `* Q; q
/ q* r5 C- K$ B8 `. c! [
sdcms.setcookie "adminid","" S; D) K% c9 ^8 \$ ?% E8 E6 d
0 w8 ?2 t5 l; z6 Wsdcms.setcookie "loginkey",""
5 S. d3 q# w ] # f" X/ X! Q% M
sdcms.setcookie "islogin",""
- `- W3 q; L& S7 ` ~, E0 Z
: D- j$ D9 h' O3 Xsdcms.go "login.asp"& _& z! e$ o3 w6 Q; R/ Z& Y6 b# v
: X3 T! `& Y2 I1 W V, e
end sub
/ a" N$ F) O( h+ i8 _
* U3 Z- ~9 @2 D " L8 E* e' r# g& \( a
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
/ t% r7 k5 z1 V0 P8 o! ~修复方案：
; z: `& q3 \% i4 W6 {3 D7 ?( L7 ?修改函数！
* d* Y% u# f$ c. J |
发表于 2013-7-26 12:42:43
收藏
支持
反对