要描述：
1 ~& |+ F6 j9 {8 d' m; f' |0 D& e* \7 |0 y/ Q$ _4 R
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试5 N; S: e. N5 n3 y8 l* `
详细说明：
" N8 f. h$ i. d, r c) ?Islogin //判断登录的方法
0 a" R$ o6 [2 ^; Z+ R' ?
1 \8 @( l$ M0 M; r! rsub islogin()
# p0 R. R3 G- l( R+ b% v 8 ~$ q8 L) V" s/ g
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then ) C! ?, p! F4 }1 \; r% v4 `
; v0 L& y/ A7 wdim t0,t1,t2 : S" [6 |1 b# B0 ?4 E' J& `
o" H, z2 j+ X' W) D; I
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
7 q" q1 x5 ?; {2 Y: m' B6 p4 U
7 h8 ], D7 w) M9 z$ A( C- Ut1=sdcms.loadcookie("islogin"), w1 n8 n7 \7 t, ]
& c; ]' R( h9 h, ^. ]. x4 |! L
t2=sdcms.loadcookie("loginkey")* D! c( t3 @) b5 J% E
; \0 Y& s# ?- _" [1 B" `if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
' M# {! h2 e6 i! ^6 b* @4 a
3 e6 D! \3 d0 ]1 [% I {0 z//
$ @2 P( j F' U
. p0 R, @2 O- V3 ^% Dsdcms.go "login.asp?act=out"6 C9 c/ p0 d& T9 b2 @
) h% G. K/ y" \1 x
exit sub
, ?- Q& f# B' D. S " w1 B( z+ W$ U/ ^2 F
else4 q; e! Q4 _& [; b1 u
7 O, d/ l9 n. V8 g1 X4 @
dim data
/ r* T( R' @! S) `
* S3 i" }5 h+ B& k6 B2 {data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控; l9 e: P8 w R% \+ T
! B% s& y7 e- K* z! v
if ubound(data)<0 then
6 p5 i* X0 _, I/ y& I' ? - i u8 t) H/ ]1 L
sdcms.go "login.asp?act=out"2 C8 S! @, v/ N/ K Y9 z. v: \* S9 G
" ^ }. C7 g* j; P, J0 K R
exit sub# v. i8 m m: k1 j
6 ~, Y0 f& {# C* S6 L( Lelse
! k8 t4 _3 r- M9 ^, |3 l7 }2 S
- e; C) U& |1 {+ W. N0 Q3 e( [if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
4 Q# _( z+ z* L( U! |/ f
" M, D4 Q1 |5 o" t2 o/ u. b1 nsdcms.go "login.asp?act=out"; l) {6 ~: [1 t/ e' G& S/ Y
8 L! i+ C7 K# t1 k# [9 u. {" Eexit sub
1 U' W5 F* A% n
% j9 i# v, {/ n& x, S; pelse
* [4 m; _) e8 t3 I1 R, B ^ & i$ r8 k, i' d- h7 X- G
adminid=data(0,0)/ X5 j, v! t6 ]
9 f- l5 R3 Z2 E+ K/ r: b% ^4 q
adminname=data(1,0)
0 z1 H( L: r1 R; @2 f! T4 P , T5 c' @- v9 X
admin_page_lever=data(5,0)
3 O0 i( ]. v+ }1 g $ l u. A6 S( }; j& a0 Q& T
admin_cate_array=data(6,0)3 `! K; i4 K; Z: m& A1 S
; x8 M+ ?( d6 hadmin_cate_lever=data(7,0)
& G& Q$ V: { ]3 C( \
" v: m4 ~% q+ Fif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=08 s5 P2 V1 I: `; y9 Y2 b
; k+ }8 {+ I5 T* L- z
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0! H7 W* _ p! a
, c0 T& O5 P/ c( @; o' `# ^
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0- t' }: V+ D3 t0 j1 l
# P& z4 {& |& [6 c/ Zif clng(admingroupid)<>0 then
/ _" Z2 m: [7 L: |1 a( J 8 w. X3 {: q- l) c9 u" m$ `
admin_lever_where=" and menuid in("&admin_page_lever&")"
1 U `3 s' T6 [; Q+ C 1 P2 t' _ e* ^
end if) \3 Q6 Y$ N1 i7 `, q7 H2 v
; O- A/ s: U8 X5 {sdcms.setsession "adminid",adminid
' q0 X1 z3 Q E+ M3 H2 ?
: ]0 U- t0 ?) Osdcms.setsession "adminname",adminname/ n7 S* d1 x$ l9 m' S
2 s% _5 T* G! y" H! Zsdcms.setsession "admingroupid",data(4,0)
* O( m. h; H2 {; Z& k 4 W3 S# ], O. X) O# t% t
end if. \3 `, B& U% u; B
" r& P! z; r3 @. w ?5 Lend if: r! m g/ `/ Q, z
5 X; q7 Z, W) x+ a5 xend if& b! ^9 Y3 w& j, N4 w7 c
2 U6 ?% w( a" T$ ^else
( X5 r- Q- d: Q9 G
- w4 C" Z+ u/ C; }8 @0 C$ zdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"",""). Z4 }/ M; i0 d+ B+ W* p
7 c( t3 A' H& X7 b1 Gif ubound(data)<0 then0 E4 }/ ~, K! I& `" _6 ^" t
' Y6 `8 w+ s" b. Zsdcms.go "login.asp?act=out"
# Z- ?% T( d6 X) ^ u E% T
$ X7 p$ b5 i5 | ?. Bexit sub
3 m& b% R# x8 H9 x6 w5 R ( q2 k. }3 n3 d `) j
else
~- M' m! a: ~" o5 ~8 h2 f8 R
( N9 E6 F3 g* }9 \! oadmin_page_lever=data(0,0)* u; i, m, b% ~ b# ~
4 M" s, D" u; X8 x) R, q$ W
admin_cate_array=data(1,0)
8 i' E ^' p4 l: e ) u3 _6 J8 ]% i9 A0 n4 l/ a6 I$ @6 c
admin_cate_lever=data(2,0)$ P* a: f3 n/ c4 H O' R
: Q, N. L6 q9 F. Rif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
% {2 s6 m9 a- _, K& m1 X. o( f - ?( Y7 u' O& @) A1 a4 {! y
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
1 i* ]; @& |) C $ W& n# H9 n% U% A" N) U
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0: h, o6 f2 k, i+ S# [; b) V
( _3 |8 J7 h+ X
if clng(admingroupid)<>0 then
. f2 W3 @; Y O+ i, q: s2 V
b% T& A, o! ?# W: [$ R0 ^. Hadmin_lever_where=" and menuid in("&admin_page_lever&")") w+ q' @5 S$ U7 \' o
1 G! [( B$ b5 \2 k9 n1 @5 {4 Hend if
6 R" G6 ?( D3 ` $ Q, f z3 b3 _6 X6 ?. C6 l
end if
( n( T7 m, Z8 u } f+ g' A6 W ' G; Z2 O7 s8 ]$ h+ u9 O+ O
end if, J& b! d. {' F ~( f) U
, c. U# P t! E8 R: S0 r
end sub+ }: N$ X" X; o; H# P. _
漏洞证明：
7 \" x$ d# h& ^+ i" A看看操作COOKIE的函数
! v$ a+ o5 t9 V5 o
2 Z; i4 \, I: @7 kpublic function loadcookie(t0)
6 ^) M+ S! K6 d' o- }0 H
& Q* X/ ]. y; jloadcookie=request.cookies(prefix&t0)" a) [- Q/ r1 J( `, p8 ^
# Q; s" o6 M: D3 W: B( t
end function! |- k3 ]* h. a; a8 w
/ X3 G2 B0 L9 }) S, z5 e2 _public sub setcookie(byval t0,byval t1)5 `" M8 C r2 x# l5 p. A
3 U0 C( M! h% U# \' Oresponse.cookies(prefix&t0)=t16 L5 s8 K( p7 a9 i
3 S7 [3 m0 D P$ q) }. o% I8 s2 w
end sub
) b0 E- o# t" i6 @
( n* A% a8 \6 r7 G m* _; m4 {& C8 tprefix! E, X0 ]. X* x0 s6 b- j5 r
" E7 m6 |% L6 m+ S& K4 f M'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值2 Q, G! {) p; X' X$ [
" p0 j3 \ G( y3 Edim prefix3 X; Z% X! G: v& I9 e
2 _% ~$ R6 r8 F9 x5 {
prefix="1Jb8Ob"
2 G4 X' R) C" @0 T 3 C1 A4 F; ?& s. z3 K4 ^ [6 u
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
" b- t6 A, j$ b6 p, [! r# }5 N: F( n
* V. _ W5 Z$ s4 s6 K* Hsub out
k' ~7 m& U- O# k' h
" v' `. R* {; I/ c, b. gsdcms.setsession "adminid","") _. k8 u8 r9 M, j7 n# g
5 m, @- k) ^5 S+ ]1 |( U% csdcms.setsession "adminname",""! X! J+ J1 F, R3 }( B
# o! g9 z( |3 H; ~, R* o8 ~6 g+ B
sdcms.setsession "admingroupid",""! ~% r# S' e! @2 S6 q
8 `7 Q: O! F0 P7 `7 \: Q
sdcms.setcookie "adminid",""+ _* f# {1 a. ?6 ]: q: d+ _
R: F$ n. s( I
sdcms.setcookie "loginkey",""/ j( H3 ]% r# Q
& C% z1 |; y k! c0 Q6 lsdcms.setcookie "islogin",""9 o- [, g' w- p6 @7 H
& ~4 P- }4 }, L% Z1 b# y! I/ Qsdcms.go "login.asp"1 _( _: O$ N- G, G7 Y
5 y! i' P& R: U% Z0 jend sub- i& f* n% v4 ~3 @$ k
1 k' h3 `+ N. H
6 e2 V" ^6 s2 ^' B5 Z! P利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
6 [4 v1 I9 o3 J修复方案：" J6 m: x2 \' J `, B4 i e
修改函数！
( i. d+ ^/ W+ T$ ?$ q2 V, W2 w, d |
发表于 2013-7-26 12:42:43
收藏
支持
反对