要描述：1 u! K" M$ A: j1 v6 m H; n2 k5 C) }
# f0 |0 }, J# C" }# o( D( ESDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试( ]- }' \6 d8 x9 U
详细说明：
; S7 e2 i. [1 ?$ D4 V, ?; v! B! w$ SIslogin //判断登录的方法
9 u. N0 C0 l, R, [& \ + x' i+ @5 Z$ E% a7 Z2 G
sub islogin()( G. K# e7 T- Y* W8 L. N
. }1 ?) v; A5 D2 Z$ |; j a4 [if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
6 w9 B8 |1 x0 J 0 A% e9 l' `) Z6 n9 i
dim t0,t1,t2 + ^ @) k5 c) B, i* {9 C
; W2 r8 G2 V7 U/ P" r" w" st0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
5 O1 y, L2 C! a! w' B
3 \. ^6 V" q( d7 s( Vt1=sdcms.loadcookie("islogin")2 v& z/ |$ \" t1 c
" E% H$ a' l8 }4 U- z
t2=sdcms.loadcookie("loginkey")4 m8 C( G( W% K) Z" }5 {+ v+ X, W. u, B& l# L
, Z) w6 ^) s8 A& \if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
6 q' v+ F" D2 \9 Q( _4 J& d 6 j2 _% P- n5 [/ V" E
//
1 l9 Z& t( c C4 |- J j( q % h: o7 u% M, Q3 L. e( w
sdcms.go "login.asp?act=out"
3 K9 w; K; u5 d+ D7 \0 P: w ; R+ D( X8 c; _% g
exit sub
+ n- K5 v ^& j; F6 @: [
' @. G H" z" ~' f( ^else7 _8 {! b! l7 a4 D0 D7 W! S- l' U
7 t j+ t, i6 w$ e
dim data; u5 M$ s) c2 @% f
. j! d' U0 B6 c! r7 _
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
! C& ~% }2 h0 `/ U6 K5 f
/ L; x& |+ |2 V" Iif ubound(data)<0 then
( o$ f7 ^: D. ` z; W
" ^- s+ o% [: m. d! C ?3 Msdcms.go "login.asp?act=out", O1 o( Q5 T2 b) H/ n6 W
( ]" o& D. V cexit sub4 \5 ^$ |% `9 n2 t9 ^
) q% w# a5 E, V' Yelse* `/ [/ |$ S: Y
4 s8 T5 x1 _/ }$ J2 C% n- S" d7 X
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then' Z! u& Q( J4 o( w# E
2 h& @% c, {2 @9 Jsdcms.go "login.asp?act=out"
1 v! \" t8 \: P+ ] e9 N 4 w& ]9 [* a; [8 B2 a9 f0 |
exit sub
9 ?, j. x0 F: G+ a* k3 J' p 8 S5 e# ^4 O+ R. v5 \5 P# s' f
else3 T, O* Q o1 Z. P5 B' ?, d+ @; ?
1 ]) b* W/ o2 E5 P5 c4 Dadminid=data(0,0)
& s9 l* j; j9 i) A4 S
0 x' h' i! p' n# l" k' x4 e5 n- z6 hadminname=data(1,0)
, g4 z% }) p N% N. \ / x+ m% F: N9 C3 ]6 T Z5 P2 N
admin_page_lever=data(5,0)' L& E! L" F- ~9 y
: N: |, z" a/ }" F+ Uadmin_cate_array=data(6,0)
& z% J" [8 `. F5 s, S1 p / [. G0 n1 q! ?: }8 [& M
admin_cate_lever=data(7,0)$ p% O# e3 ]& {8 \) q
0 w- Z9 A8 }- v- `- T4 e
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
( o; W! y: D, c9 z 7 x5 K: s7 h: x% p1 v
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0! ^5 _ f- o. p9 s6 r
: U$ a8 ~. c4 E M; M, H3 jif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
3 e5 d; d1 m5 x9 @! n
) g* {- H* A1 y" _' vif clng(admingroupid)<>0 then
) u r1 B) T, d& H/ x- f* N
2 Z7 B. n& v0 v$ d* ?admin_lever_where=" and menuid in("&admin_page_lever&")"8 f6 t9 i) a0 i
+ T( g9 N0 {0 m/ b+ e% o
end if: q! z2 r' k+ _% t
4 T X- o! A8 _4 X0 ]sdcms.setsession "adminid",adminid
O* r0 v* E( U9 P* N
4 h; b/ d1 U3 [' R1 |: Msdcms.setsession "adminname",adminname
9 _+ ]' |: h2 K. T( D' e* N
. F$ w- I% U3 o3 v7 v, }- G& Gsdcms.setsession "admingroupid",data(4,0)0 o) L$ ~% o8 A. N. f
. e5 A. n8 H. l+ Yend if
4 S: J* N z4 R0 d, z
5 h" o* O9 ] ?/ m& h9 send if
M# q3 O7 \& v % d! c; V$ d0 a s8 t
end if6 v: t; G: o: J- k9 S
' k4 k5 u" P. ~; V( yelse- [" B3 D5 W6 [2 d0 u* C
: S/ V8 _+ I: r G2 i. `
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
' c; F7 o! Z. t# j7 H) T & D/ {/ e4 K, K- Z/ `5 w
if ubound(data)<0 then& C) T. c2 T* j; S+ ~
8 f. f. l' u- e% x, K9 [sdcms.go "login.asp?act=out"5 |; q! L& W! s) i. R5 c: y
4 Q( M5 y, b' T) N: C1 H. E
exit sub: i5 ?& K9 b" _% r: e. N
0 Z4 g0 w$ ^1 u5 ^0 @
else2 y0 |: l- D' {# j% w, g1 B, ?
2 r _ ~6 V$ D% t4 ?# @
admin_page_lever=data(0,0)+ H, l2 _3 c! s9 C- p( {" o
* R: B6 }6 j, @) Nadmin_cate_array=data(1,0)% ]7 q; ?4 b; S! D6 G0 ]! a
; X# E* S$ T5 o* q L+ ?admin_cate_lever=data(2,0)
$ J1 y& L/ i4 n ! Z" H# c0 c" r. v- @7 B3 w
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0+ N1 ]0 H1 R" K3 ]4 q, A) a$ }, B
- M. b/ k: h8 {/ J7 v
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
+ ^5 m, l$ p' `. N9 z( k1 d 9 _9 z5 D1 a; C( A6 T3 L" Y- ^
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=08 }3 R. I: T4 v6 B
: X5 U; w0 v+ J# I+ D8 G' Xif clng(admingroupid)<>0 then$ e8 s. N/ q! m4 S/ F* L7 `
5 L$ W2 m9 R$ r Y
admin_lever_where=" and menuid in("&admin_page_lever&")"
4 w( c1 v6 u# c/ p" C; h / w+ X8 j* }( L0 d" s5 x' {6 ^# E1 E
end if
+ n) q! o- I6 S% L. U" j % q6 M/ [9 q! m% R
end if/ z2 k+ n3 q2 i! @# n
+ |' {# ^& T8 c' X+ V% aend if
0 A+ o4 d. B0 H6 o $ ~2 a9 J+ r' M8 i
end sub
+ }$ o) Q& }7 N5 R* L漏洞证明：+ g$ j& f9 l0 u6 u C# c- k
看看操作COOKIE的函数
! A2 l( A6 J$ ^$ ~& Q. Q: N
; m+ `- B% B8 \4 w: B% cpublic function loadcookie(t0)8 M) g$ @( F2 A) O
- Y9 g6 f- y2 _* [6 T5 R% G" U0 Y% g
loadcookie=request.cookies(prefix&t0)
5 \6 T) C% H% M* ?( }* l+ F: j
/ N5 d- r. u3 L5 [4 H; rend function
8 ~. g& N! R8 X3 d! c 2 o# z) g8 g' @. l' S" K
public sub setcookie(byval t0,byval t1)
a# ]$ _% J1 H ( H* W, J" [: i; j+ z' i
response.cookies(prefix&t0)=t1, @7 c! l. i: f* V$ q* {; Y: f
5 p$ a. O, U5 g. F0 nend sub5 [/ U: |! s: D/ h3 ]& K
b+ q, f7 _* h# f+ N/ Z
prefix% F$ A5 E& W8 H- ^0 [! O
6 k3 R, c# U# L& d'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
/ Y. k1 w6 ~7 v3 ~) g
* Z u; d- w0 R d$ Qdim prefix5 p9 o }$ E- i/ h/ ~
' m' X, i4 g( mprefix="1Jb8Ob", {3 N6 ]9 L; O% J
7 L/ Z* E, S; F'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 & W1 K, D7 U c4 ]9 _' H& n& z
/ u) W0 V9 @7 D' s8 Y
sub out
$ @. R- d2 N4 ]/ B- q( ?* M/ B ! [( y8 D: y. F" K- }# `7 [
sdcms.setsession "adminid",""
8 n4 ^) ?; l8 J8 E4 P * n+ F5 G2 d6 X
sdcms.setsession "adminname",""
) M' J- G9 g: J B9 _9 ~. n9 Q/ t
4 y! `" U- h9 S* ?$ psdcms.setsession "admingroupid",""1 R- ]! ]7 \0 s- x
) `) M* ]. [* Vsdcms.setcookie "adminid",""
( S+ H" q1 S$ l
5 G8 P2 C; w$ D5 Fsdcms.setcookie "loginkey",""/ H. A% v* U! z" \6 b% A
9 z; } ~$ b5 d5 \: ?
sdcms.setcookie "islogin",""/ P( ^, }( _0 `
! j }% r2 O4 V) b7 f, X2 I
sdcms.go "login.asp"
9 i! P1 v t% X5 h1 V, b5 j
6 ?8 n+ U4 U- [/ zend sub
9 R5 M! N! v$ @" ^4 s ' N: S, d) l- @+ E* c5 g
! R* {( t, |" S; u$ W. Y
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！/ ]" @4 W+ W i* O) h: i% r
修复方案：3 R3 M6 M/ T& K) l
修改函数！/ X3 d% E) m1 X ]
|
发表于 2013-7-26 12:42:43
收藏
支持
反对