要描述：
0 O- H* \$ l+ t5 e ], o& C8 y: N
& }1 R4 u: I- I8 ?4 |SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
; z- w" T6 {& a: d( c9 m详细说明：
# `3 {3 s& K0 I$ d) nIslogin //判断登录的方法3 j7 V7 L1 g# ~# W) X" `/ m
. E( D o% ~/ s2 _sub islogin()% s; Z$ H! Y9 F( A" [; b
+ g- P" l# o, g% T$ O" Q9 o
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
( P+ F2 M" h+ n * b$ k: ]- t0 ~- @; I, M! M: l$ a
dim t0,t1,t2 7 K3 W; }& T) b
6 u: m- U- a4 ^
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
# C2 D2 m, V7 \0 R% T* y + w1 X( ^6 C+ P/ U6 u
t1=sdcms.loadcookie("islogin")3 c( }* H+ ^, d' [6 `, z
* s; V! L! v; u1 a3 v7 et2=sdcms.loadcookie("loginkey")
! M; W( j' j3 u0 `* y
1 R! M- V4 b' i* W8 dif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
0 X* k* f4 { M
7 H& p$ n% R$ y2 v1 m% t& q n//1 }( D: q. j1 h8 F8 L( [
0 p b; y; R9 O3 E+ A2 K; W( h& l
sdcms.go "login.asp?act=out"
+ B2 a6 h& y, F3 j. c $ J7 M) w# c4 g; s s# v+ L
exit sub- S- u/ F! i" r
- x) R6 X" V9 Z% d7 C
else
/ ?) l5 d) N, p6 i6 o7 A; [4 R8 C
) F" I: E6 k, D( U0 Sdim data ~4 a. R) P7 T# |9 \$ W
9 \: f, s0 V4 z [, r' P- Zdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
' r# Z" z5 Y2 s5 ^' {+ K
' i- E8 m& ]1 \) V& \7 rif ubound(data)<0 then
. T2 e) R4 _- U. ~+ r+ Z 9 \4 ?5 ]3 E- b, Z2 X* s
sdcms.go "login.asp?act=out"
% y( x7 ~! h8 H* P1 h% r
! J3 }: c2 m& O4 \" E- |* Eexit sub4 n: E3 Z7 R( s/ O# b8 P* s
+ `$ P5 z+ h; }' |" E
else! ` w+ U% Q) J) m9 `; C. T4 C
# v% t7 K3 r: _. H$ o5 |if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then9 v5 N8 k+ t: r e2 T* {8 K- I6 c' J
) J4 e( w% y4 M* Csdcms.go "login.asp?act=out"+ r% t3 m' C+ u# U/ z! @+ D$ i& y
% O/ g+ r+ w1 e2 P! }: ~7 T/ W
exit sub
7 Q% |8 r$ a; r& |; x2 L
2 Z: \! V6 v5 H+ c0 A7 N. a" aelse
" E# b, M: Y, L 3 A0 M6 U) X' b
adminid=data(0,0)/ ?- N! ^1 \# [4 H) c! t+ f
! B E T' H$ {; Tadminname=data(1,0)
" T7 {8 V3 T* g" r u9 P$ h2 }8 P
admin_page_lever=data(5,0)
4 ]+ v. r& M# n% _8 b+ x- Y
2 i( P% C7 n) g- Kadmin_cate_array=data(6,0)
5 @0 i" ^' \$ V) ~2 c. v& n
2 J/ v0 e) a* i; O6 I9 F2 H& badmin_cate_lever=data(7,0)2 ~0 g+ Y4 L. w9 u0 `7 G
! y7 \' } Z/ `! h5 s; H# M
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 _8 h1 r& w3 b1 S n% Y# z
2 S; N5 z4 D$ M' M, q' Lif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ M' k2 H m) J( ` 8 D- T3 s6 M% Q; ^
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=00 X3 e! V0 O0 I2 N! k
- Y6 o) S# B. n. _7 Nif clng(admingroupid)<>0 then M( O, y: @7 v2 H2 x9 |& T4 U* L
" Y3 @+ Q* O/ D0 p" W; \
admin_lever_where=" and menuid in("&admin_page_lever&")"" p n' x3 Z6 I) E i9 T7 C
* M) D8 w5 A% f, T7 U2 Xend if
! E; l) _0 u6 o7 i) q
& {% [. K1 [4 M) X$ R8 @4 Zsdcms.setsession "adminid",adminid
. T6 E! m3 O9 H D) U& N" @8 } $ ~0 m( y& W6 t: K
sdcms.setsession "adminname",adminname7 Q! R& F4 a3 U
& Y3 ^; z8 i/ U* p) ]sdcms.setsession "admingroupid",data(4,0)
7 O+ I7 v" r+ R6 s6 p% H
& [, O& {' d! v& S8 Y* C- f9 Kend if; p. b2 o$ C: C& D
- p6 w4 y7 V! o+ X! P* ]end if
0 k- G+ \% X( m
) R. E: P% D/ Cend if; E1 e5 W' _ `' a
2 J$ g, d ], @) d; d( t5 I; h2 r, Z
else" W/ Y! I# A0 l0 ^/ Y
. u+ J. H% C5 I, g1 F! gdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
( K; z* s! v; v A; U/ K " I8 W, a, q' x( A9 I$ [9 B
if ubound(data)<0 then
- D3 n! m6 L, Q4 L* ^% }4 o) l 0 H# A" w# f3 T: D* a0 h
sdcms.go "login.asp?act=out"$ y1 y4 {8 e! c; _3 @0 U" H
" O ~! H; X8 d1 _
exit sub
; S1 |% Z, b6 @2 t5 ~$ a& S
/ p; Y4 s8 p( N0 u4 delse% I# Z' S. _5 \4 p# z% a# A* g3 z( q
3 x8 _: `6 w4 u7 _6 ?9 Q6 l2 q
admin_page_lever=data(0,0): K5 c3 y% n/ ~. q
4 B3 G$ C+ X* x& _
admin_cate_array=data(1,0)
: c6 n% k+ Q& T7 {# k 3 m% B8 { P# h1 _: l! i: M
admin_cate_lever=data(2,0)- N' c4 D5 h V; X9 L" m
( R, ?, Y3 l- z6 J4 A6 G& r
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0' a2 @" X/ V) \7 g" v, v
$ o A* X {% Q# N. @if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0: y& W( B, I; Q" I
+ E/ N/ q0 z; f0 I, }: [
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
9 H" e1 Z' A" q9 Q; \2 n ( G0 F6 Q/ k' c3 r. j8 Q# A$ g
if clng(admingroupid)<>0 then
, ]2 Z: `0 _+ G( ?' [3 r
9 _/ q& ~! _2 w1 b$ l" H- Uadmin_lever_where=" and menuid in("&admin_page_lever&")"
- w, a' B9 F4 z; j$ R: Y
; \% m0 L( s0 _0 E$ o: R$ Cend if
8 k. K6 b( `2 L8 E" p. j & Q0 q/ a2 I6 G
end if1 q7 C& t% i" h( {
$ v [6 }6 B4 ~7 L7 M8 v/ {
end if6 `9 b. K2 M; A. K6 D5 G
* V5 a4 D" f5 I( i: Q9 j Jend sub
7 @) }$ R7 V. g( T0 O( n. T漏洞证明：
9 }- @) E7 Y, z, W: [看看操作COOKIE的函数# M0 a" a, g3 t" }- j# g
* M* ^ ?( t" Y0 m" h+ p: L) Y$ apublic function loadcookie(t0)
' z% V. Z) o/ }$ |' T 5 r* R' ~: ]6 } `
loadcookie=request.cookies(prefix&t0)( K; L: a7 V: A3 |/ L
& Y" R5 U( w; l1 C; _) P; U. }end function
9 k" C( W) F" `8 m; D6 D
0 W/ j0 M9 }$ r Q: xpublic sub setcookie(byval t0,byval t1)+ p E3 } I/ ]1 k6 k3 ^
) E3 Q0 x4 w! K" ]response.cookies(prefix&t0)=t1
( ]1 X. l0 k$ q7 |: i; r5 Z1 U
* f' K# [8 q: c2 N0 }" ~end sub# r: `) ?8 C' b, q
4 s8 |6 N t) k# E1 H. c) iprefix
. e' }/ o& Y% r7 N9 n0 h/ P
/ L! B: d# }5 L5 g9 G1 l; y5 L'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值! P% {7 {2 R! }& {9 C
7 F# @! f4 [! a% ^6 Tdim prefix
; ?8 p" L& e$ E( s 8 d+ A+ Q# u8 Q3 d& A
prefix="1Jb8Ob"
$ h c- ]. z# Y1 m" A
& Q( r. P7 Z8 u& U2 G'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
9 O- Q7 j% G+ ?, E- M& C. L- m5 X B7 z/ F0 B& z0 o
sub out0 }* L1 w9 g4 a) \, L# ?7 h: v
" s3 H' A j, M( d
sdcms.setsession "adminid",""
+ x( r/ F+ [8 i& M/ N7 H) p$ q; Z
2 l, U, D9 K- V7 Isdcms.setsession "adminname",""
: g3 h2 [. g- e _; X' e4 [5 S4 J- u1 H) V
sdcms.setsession "admingroupid",""; y6 u M8 Q0 M9 ~% R0 k/ Z5 y
1 o$ D- v# Y$ wsdcms.setcookie "adminid",""9 S1 S" s3 \( B4 d
7 T e E2 Q9 a
sdcms.setcookie "loginkey",""
u6 E& c( ^4 k7 n* g3 H 1 i9 l/ d+ N5 K2 H, D) G5 ?
sdcms.setcookie "islogin",""3 \* O4 S% |$ U1 [# J3 h
/ @) ?0 W8 U5 `2 R
sdcms.go "login.asp"7 O0 S/ u8 R; Y: d, {
, g0 a9 ^5 A6 ^6 vend sub+ }) j" k# T) T- C8 r3 k
+ q& d' Y7 P: B: n' [ o3 S
+ J* f! a5 S3 x利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！/ S% A2 }1 i1 S" i5 w$ p: u# D
修复方案：
1 @6 }, a& M3 j. X9 h修改函数！
+ E$ F3 b w1 [. W) \$ J; t |
发表于 2013-7-26 12:42:43
收藏
支持
反对