要描述：
$ Y& \$ l5 e* ~; G* y; N0 }. @
' q. q$ y$ m! j- GSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试' C4 w& k. O2 g2 n
详细说明：1 W/ q( x/ Z; k1 e, Q% |3 m5 x0 a
Islogin //判断登录的方法- s; C, |1 M& F9 g% x
, k2 t' b; h |$ W7 A; Vsub islogin()
9 W4 z" R+ Q6 b" I! ^) v
7 G9 k, U. Z7 X+ G' a3 tif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then / f, I& r1 l4 s: e: n! Y" J% Z
8 W F3 u0 d, b- q- s: Ndim t0,t1,t2 . K' y! ~6 c4 y: V+ D) E/ L" ?: f
8 f* U9 P; ^8 P6 G, wt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
) m7 I4 e |& `
] l' T, Q4 A i1 M$ G/ et1=sdcms.loadcookie("islogin")7 y8 @( r3 a8 F0 v G, r/ z
: n( P+ I% R, c6 u: a
t2=sdcms.loadcookie("loginkey")! E2 E; f" B" Y
2 I! z0 ~1 C' R' x! _* Jif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行/ A' W0 @9 `, G% K+ @. W1 Q- i, X1 u
: P' \ f* H/ e+ j1 H# [
//6 D' C% e7 U6 t% |5 k" P
7 r. S7 @& `4 f% R) y6 Wsdcms.go "login.asp?act=out"
: `- }8 B6 m0 Q8 X
! v% X5 m% `0 K/ w$ U/ Q7 j- f; |& Xexit sub
3 V% ^1 ?, w7 y M8 B/ w
- N2 D$ w3 M4 ]2 l- `5 [8 z- f+ U1 Felse8 Z: ?6 e! r% t; t P. B% k C
' v: B/ k4 }+ Z, e1 s# J" Kdim data
~: h' E, k. ~: r P8 Q& q8 k
6 ]7 I# t7 J# L) x5 q/ Y+ g* Gdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
r* w# H; O1 a0 I
* S# N2 g5 G# Y0 M C. Iif ubound(data)<0 then6 F( Z5 k* U- Y4 W) ]
. V# E/ w O$ U0 B0 p9 msdcms.go "login.asp?act=out"
" d0 I& M! _' z; P1 ?, v' n' m: j
/ t" C- y4 N, X$ G0 Jexit sub9 M' Z# B) M* H7 p6 @
- ^ `& K8 h& j0 h4 ielse1 Y4 t0 H7 p% o$ M o, ? ]
) U# b) O$ W! O' T( j- H: A+ T
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then j+ J4 B1 l( J# ?1 e: j
& z7 e8 |0 w7 u1 v9 i# \" y, Esdcms.go "login.asp?act=out"% I6 b7 E- a$ J% ?+ I
6 Q+ l, ^* F) [- @exit sub) e( d/ F v# b5 Q+ C! Y
' i% |; j$ F# V8 P. A, U4 t
else
6 P3 [) J8 V2 m4 ?. g " c$ m& F- B9 x. @( H
adminid=data(0,0); I3 m) r( g2 m/ f# g0 Q Q& i$ }
% B5 {) O5 M5 R# a! q* A+ \adminname=data(1,0), ]: X+ o$ K6 e" n( e; h
8 W& n3 x* @+ J* p8 V3 Kadmin_page_lever=data(5,0)
6 W2 |* l& J4 t% E4 l
# W$ P* K0 V( wadmin_cate_array=data(6,0)
7 H+ ]/ M, E( e% n4 J8 h
) K7 A7 f& {5 ~0 X0 Padmin_cate_lever=data(7,0)& k" }4 D" ?2 W' I3 C+ d( f
7 S4 g/ e0 j( k+ @# Tif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=06 k9 n1 Q7 H4 h2 {- w4 e$ \
1 f, j$ B4 r/ R2 _
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=02 O! n0 Y" k# b. E* \
) R- r9 H# B; B5 a, f
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
) ~1 P& c' |. l l6 n6 {0 P! u* Z: F
if clng(admingroupid)<>0 then
7 J2 x& J k' y6 Y( l
& d% O& e7 Q; C5 s$ ]: m; iadmin_lever_where=" and menuid in("&admin_page_lever&")"
# |, [2 H v6 @# P! y1 f
; T# c* v: [, o$ R1 h! D. P4 _end if- x. K7 g. _# h0 e7 t
F( V$ k3 L4 s: D. n
sdcms.setsession "adminid",adminid
/ x# ~8 r E- r( R H! E" E 1 j, p8 ?, i5 u* S0 @3 X8 `
sdcms.setsession "adminname",adminname
# @6 w! X) q8 e4 F/ A # X2 k: Z( S* F' g* d6 v [/ r
sdcms.setsession "admingroupid",data(4,0)
2 `, X- Y2 V* j 2 E7 `) k d( j8 ^2 p
end if
& v1 j8 Y( @5 P+ e * X6 e' ?, W* I/ C& a: ]
end if
2 h1 ?1 F9 H2 M# r
7 u+ k7 L7 N# {2 o, cend if* i7 T: @( s: [
6 R0 W n7 I* X
else
" g+ l1 _. y9 {3 G. K# Z* @
0 G' o& y0 \; V, ~( P7 Odata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")# P1 U9 X8 U0 i: e7 A4 _5 {
9 g0 T. ?0 m7 h) Z3 q* y
if ubound(data)<0 then, a7 J4 {% ~4 R2 \( e/ k
" k% g4 p! B) p" l8 r" Psdcms.go "login.asp?act=out"! F) c: [0 d0 R* F8 W- P- p
1 h6 b5 G. ?: W: ^+ sexit sub' ?" z& S7 Z/ V9 Z' i1 h; e
. f8 t: _' I/ ]$ x" r
else$ U- _7 I+ Z) V, `6 G
! j5 `" A" @# G9 x4 Y3 F
admin_page_lever=data(0,0)
$ |+ g9 t, L& ~4 i# K* y + F) g' l$ b6 j& Y/ m* |7 M
admin_cate_array=data(1,0)) o' s' F$ _# i: \, g2 k1 y& }' R
! ]7 c) M4 Y$ O( a$ @
admin_cate_lever=data(2,0)4 `0 z0 h. Y _9 x; ?
, V8 u& ^. U4 V/ T
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0+ m" M% p& N( q" w7 L- @* }+ ^# F
" q* k, H1 |9 c
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=03 ~8 p& z5 ]* f; M: L- E1 P
: `* w9 |, G( W& `3 x& y( ~if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
% M$ m& h3 L; b# J
) N# Y' }" j; j5 B; xif clng(admingroupid)<>0 then
8 {% D$ M T4 _5 p. n, c
, w( A( W; x1 w8 K* @, _7 radmin_lever_where=" and menuid in("&admin_page_lever&")"
5 ]9 `1 t8 |! K' C9 E$ Z7 m- d) ]( D
$ S! ~$ X9 L; ~: \) Yend if
`4 j0 N+ F" t; L" a ; Z( f5 f* H' n8 ^1 I, ^5 q' Y
end if
' H( i. o, X! i1 d5 T3 K0 {+ W
6 O# g8 H) W- F7 `0 `# s: y5 g0 cend if6 ?/ k2 u, n# n' V/ h
$ O/ f. Z& i! {. T
end sub
. O8 V3 a: F0 V) g: i, W& z漏洞证明：
% Y1 P' H# ]! c+ J看看操作COOKIE的函数+ G4 Y' b9 j$ \* H( P/ S
) g! c! |0 ^; [/ w! \
public function loadcookie(t0)
- I3 P) I3 y% k; W 0 F* C% Q0 N! h( ^
loadcookie=request.cookies(prefix&t0)4 E3 V, h3 h9 s' C* W2 ^
/ c2 Y1 }! L, i, b( Y- Yend function
( K- I# I7 r \' q! v6 S' c/ d8 ^ 7 F/ ^6 R, ^' f) r
public sub setcookie(byval t0,byval t1)
$ T; O' F0 {+ N
! D7 ^$ l$ g Q: z; S% C! E+ K; Y1 ~response.cookies(prefix&t0)=t1
/ X" {& |5 J }1 @& L! ~! s! r: d1 v
1 r& ~6 Z, E6 I: Lend sub, z# ?8 @" p& t+ \3 Y+ i2 r. i2 H
* B5 C: w% E& u5 h
prefix
W. q0 B1 }/ C. a% V
6 J& _/ C" b' L3 W3 |'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
; s: T4 @$ ~* n " b- K/ o1 P: \: S
dim prefix
6 D) e$ M' p8 t* V; t3 z9 B + K. F K% x5 N0 E- E3 D
prefix="1Jb8Ob"
! B8 M- l$ r1 Z8 i. G0 x ' z' L2 O8 R% Y* S1 _
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
5 r7 [6 [' ~$ W- e5 L. U- X& K
5 ^" V; o' i' a; Asub out& Z% J5 _% t# y& h; |4 ]
% \9 s7 F" l O" W/ F0 J; [8 {sdcms.setsession "adminid",""
% ^0 V- P- _) L- H1 v # g# X- }$ r- G, @+ z
sdcms.setsession "adminname",""
2 G, ]) i! c2 O( A 8 H" H9 h# K2 ^+ s: S: `. P
sdcms.setsession "admingroupid",""
2 o* S y& i+ B4 F- n; x ( O( x/ b# N$ q5 L# ~
sdcms.setcookie "adminid",""
# [3 d4 j3 W) x! M4 n) h) `
# {; @- t4 G/ N# p2 Q2 t6 U4 r& lsdcms.setcookie "loginkey",""
1 ^ J& W0 {( G% N4 o, e
7 `" Y. I, z% {5 `sdcms.setcookie "islogin","", Q& D6 d/ G# v5 t0 L
. W, I3 o% L4 Z! b1 O7 s( ]* nsdcms.go "login.asp"
+ d! q: C$ ~5 h$ ?# P0 d* p
4 X! s/ Q/ N8 m2 \6 S y+ \& Oend sub
+ O. J6 i% t) \5 ~: W' ] , F! C P! {5 w9 j, K, X
) u0 S' X* b! P
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
2 M2 t2 u0 [8 F# c# J8 `8 t修复方案：
. l. m& m7 Q9 T+ {" j修改函数！1 m5 g5 S. i7 W+ i' F
|
发表于 2013-7-26 12:42:43
收藏
支持
反对