要描述：
; p$ W" H9 u0 d" z7 i
- r0 d1 k5 s3 \; `SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试8 k: Z5 ~& q% T9 b# W' {
详细说明：2 ]# t* ]" A& X; E Z
Islogin //判断登录的方法
; @# |- C" f8 c" M $ {/ D; e1 \: r+ n) t7 D" S
sub islogin()- G/ i. g3 z1 Y; p
% _" S" H2 N. [9 u4 K& c5 g4 o! \
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
6 |1 q, }4 J; S7 I 8 K6 a+ M t# t$ q) ^7 {
dim t0,t1,t2
, k, a8 m3 C l3 I) P 1 d6 v- ]$ P! v# D, ]6 ?2 W
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
, G4 u$ g0 f% [4 W7 q4 Z 8 s5 A% h, ~1 f/ R7 j, \
t1=sdcms.loadcookie("islogin")' l0 d% K9 L, Y3 \! Q- N" z
: n5 s! |* t7 pt2=sdcms.loadcookie("loginkey")
, n& s0 h8 |5 k1 u 3 P8 J' u: S" }' v/ ?/ h. B: S* n: l3 y
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行0 j. R) [5 _: U& h2 n7 X
( E' Y* E4 g6 [8 u" O9 S//' ~9 b! g" j5 N! o6 I
z' T. g" k( D; C) y- z8 ^! \* g
sdcms.go "login.asp?act=out"
6 d) B! b# }1 N$ M* x$ T
' P/ f3 D" [6 Z+ Iexit sub
% p0 D, f+ g3 T. q- Y; B
, d( }( P9 J9 S: nelse. ^8 d- z, i5 L; o2 [: B P- O
: s) h; v. f+ E+ R x" d& [dim data: `& W3 W/ q1 _, L& P' k
- X4 v8 L9 o+ o6 o/ l
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控/ c! d$ ]5 T$ [* f5 S5 O* d/ t
+ }" \1 p- f& |. {# ^8 aif ubound(data)<0 then
/ \% V. t. [# G5 U6 w4 W
! C0 m- d( w- v4 L( Gsdcms.go "login.asp?act=out"
9 P+ ?! z9 _# M N
7 s) A, L; N/ K# ^. hexit sub
! t" @: y6 ]" }" y$ @' n5 J 3 V# X# p4 z; p# y5 ~; b d3 {0 M
else
/ N, Y/ x4 e2 m/ Z
' L2 V- L. i; o; {, x6 Bif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then6 Y$ b& x/ X. ]; D3 N
7 e- i# R' x& Y) w4 Q9 n" d
sdcms.go "login.asp?act=out"
, ~" C/ L/ Z8 T | 1 S, Y- N- h* a3 E/ z
exit sub0 P1 [5 } x/ O4 s! g
* o$ L2 E, D" }* r* Telse
' V9 W' z# f( t, X6 z% s
( Z! D- `$ {) C5 H3 ^- k4 Kadminid=data(0,0)+ h% x6 |$ ]5 m" C- W
; G4 H4 f0 ~. t; C) Y3 B( R3 i- dadminname=data(1,0)
% [9 `: P. L9 e8 i! a
, ]! G; j8 g0 i2 n- K' {admin_page_lever=data(5,0) ?0 ~ T3 s3 u( S( W/ R. ^
. G6 S" U% w- Z! w1 C' Q" Z% Y
admin_cate_array=data(6,0)/ G+ H" R6 K a, I5 ~0 U# v
1 j. [" \0 b, p( B+ m* S
admin_cate_lever=data(7,0)) d; p; G4 G3 s6 p2 ~1 j5 b
# x4 P4 Q) a$ ?4 K, Uif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
! W$ F8 {) {) P* e9 v# p; a 0 ]' G( R* F6 M d
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
0 I: U& ~) Q/ w8 R: C1 U4 G3 H
# X1 n* w8 ~: j3 v9 uif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ J8 C6 G. v+ L
# O$ c: ]0 u. J: Hif clng(admingroupid)<>0 then$ g: J4 b5 g3 N: v. I. v: M
; w* F' w% P/ _. O G! ], `6 f
admin_lever_where=" and menuid in("&admin_page_lever&")"
$ P& C6 B+ Q$ X' l , s- g, }) e! N8 P L
end if' _7 E9 e. F; p4 I. y
8 N, H* x }; S& d+ D# j0 G# C
sdcms.setsession "adminid",adminid w$ k1 v4 T: r
- H) Z* ?0 F% x$ n- @5 s. tsdcms.setsession "adminname",adminname
1 `6 o% j9 b5 L0 @; |
& s) t. C4 `, B( ]sdcms.setsession "admingroupid",data(4,0) z) ]2 u- K. z% M6 e
% H/ V; ^3 [: N3 r8 R+ |) Y) \% L4 T
end if$ z2 }4 }; c+ I2 @6 V* c9 S
; p {( `: o2 C& I
end if
3 @9 w( T3 T4 [. }1 m % z9 ?+ i; k& O: J& y- k* e
end if
p( V. ]" k, G g. b/ w5 j 9 `. H3 t2 P2 p' f
else, ]4 Q" P( w( W1 H/ ] O! K
7 D0 D! G4 J) e
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
/ D! \3 n5 o! C6 e$ k3 [+ z / p2 k2 w. i7 ]5 C4 S
if ubound(data)<0 then Y# f b( A Q; _" V2 E
6 y, X+ z+ V7 P) G, ^# X# b; H5 ^6 e' s
sdcms.go "login.asp?act=out"
( y* i3 G) I! V$ p+ q 7 {/ o O& C& u" v' c3 u6 M4 G
exit sub
( t+ D; c7 g# x- e' @2 U4 x, ? ! h ^- ^0 P! r0 d- ~6 _) m
else2 P6 p! k& e9 L9 W
( {0 z& W" C8 X( b1 t, S
admin_page_lever=data(0,0)
( Y/ D. ?9 B# ]$ h U* e; T 3 D; R9 i/ V: x2 \ w1 n) [; @
admin_cate_array=data(1,0)
- C; U" [7 J) a
6 P2 W- y+ D! P) f0 c) Oadmin_cate_lever=data(2,0)
% n: U; j$ v$ N) M, f+ d6 M5 F7 z0 y
* Z* l9 _7 S# |; Q/ t/ Bif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0: }# U2 q$ ~( h
) k7 a. O9 M! T3 L8 pif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
- n. Q1 p3 C2 B( t$ d5 ^$ D% k) M
3 B) r( \6 p9 [' `5 r" Sif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0& H$ P8 r) ]' K' P2 Z3 }6 R# s
) L1 P1 H+ V: o( }+ t% @1 Rif clng(admingroupid)<>0 then
8 x* A; y2 M! k& d* D M. }2 C7 N: [8 o' {
admin_lever_where=" and menuid in("&admin_page_lever&")"
?, ~9 O4 s1 V! x% F* c& ?
" {# K$ w" N# F; V- g1 S# Yend if
( i; d1 o+ [7 H1 N5 t! ]& H
( G9 f( l' ~: {8 ?" @* @end if
3 |. _, W, U9 J) h) m( x4 o3 w5 y/ G 2 e1 {8 \% M6 Q2 H% r9 z" q$ B# s* @
end if+ i6 d2 w, f F# j2 _& O4 _$ L
$ I n, q: T3 \3 D
end sub
# Q0 F: E' p0 A( b漏洞证明：+ {2 @/ Q: b8 p
看看操作COOKIE的函数0 @2 |; `# q5 `0 l8 Q7 i. R5 V
8 @3 R6 T( G4 N7 Q+ @4 b! E% Xpublic function loadcookie(t0)' ?' C$ t- R6 y, J. w3 @; a
, e/ U" P2 n" A* Q7 t( g/ K
loadcookie=request.cookies(prefix&t0)5 e- S" k% G% I% I
' F0 `, s5 Z& ^" k5 \. Dend function- a% |+ J4 C5 q
6 R3 s6 {; [2 L+ U+ epublic sub setcookie(byval t0,byval t1)# b s( C1 ?- p, @' E- A" u
' U. s$ J3 O3 Zresponse.cookies(prefix&t0)=t1
! A& ^+ S; b: q' V
3 K% A3 ]6 r' q; U& }: `; Hend sub
( x/ A+ E" k+ i1 Q% f
2 ]* p, u8 Q* D9 g1 q2 pprefix/ Q& v0 h- ]6 @. j. f; ]
) @0 t! |$ y3 c7 o7 J: H'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值2 [4 R# `" k |9 P$ _
4 K. t0 ~, M; T2 Edim prefix
3 t% p, W/ N. Q( ]
# c& }4 ~" O3 v( Jprefix="1Jb8Ob"! T1 J" q! k r# u; L4 J
2 z" u9 U7 I9 h. T0 X2 h'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
" z! ~2 w( N# G; G% D/ c! T * r z) m7 z& X5 }! e
sub out
2 A2 Q8 w n1 i$ J9 e 0 `4 J& Q( x( D! E0 L
sdcms.setsession "adminid",""$ i) ]/ Y1 {. i0 d$ H& l. y& m
" r% b$ W" D$ M
sdcms.setsession "adminname","" ~6 ^' ?3 {( D) _: _; W* s- |
+ G) Q, i. ^0 J1 ]4 i, o+ x
sdcms.setsession "admingroupid",""+ E, X* I: d% `- c3 b# M2 Y& P
4 R$ A8 {/ Z0 J- o. y& f5 i, @
sdcms.setcookie "adminid",""
' b, u7 e5 n$ P1 @3 m
) l5 c0 _+ C7 R ^$ \7 C: Esdcms.setcookie "loginkey",""1 d$ M9 T/ z9 y+ F
7 w5 U1 S; j+ }sdcms.setcookie "islogin",""# w4 U; G4 Z+ f$ \9 x
5 E& A" ?! x- V1 {& W1 T# r
sdcms.go "login.asp"
1 n* X. W5 }8 B1 A) ]! D , t% b# L3 M; ?8 @
end sub
! y2 o3 p# m5 K2 {7 F* U6 `# h 1 {9 j i0 q0 A3 `& W6 |3 X0 b! }6 i8 e) P
0 [( X4 m/ j7 Y" T+ v: V
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
% Q+ \' f* u: `+ Y3 E修复方案：
0 _6 ]. }6 ~3 }修改函数！
- X7 c! s/ Z \% r P |
发表于 2013-7-26 12:42:43
收藏
支持
反对