要描述：" k- n' d% `# `# M
9 {- o" j/ J7 D: g
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试* y2 P- w1 C9 [# Y
详细说明：
& V* l$ e2 y! yIslogin //判断登录的方法, z& ?/ e8 ^) y9 _
" V4 r8 L; P9 Xsub islogin()
; r; y' E( j p7 p2 Z
0 U5 ^- Y6 M4 R- bif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then 0 F4 s% w. ^/ u) p; ~( z( ^
& l }( f# X4 q* A* Zdim t0,t1,t2
. ^" e& O( ]) q2 k- _: r 3 W. O& ?, D: b0 g# z' L
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
/ q3 h( h2 J8 _6 e* a8 M ) j* e g$ l' }3 n7 H9 D2 @7 ~& A
t1=sdcms.loadcookie("islogin"): k8 k; N8 }9 v }# s% r, j
/ C+ }4 p. D0 c& {
t2=sdcms.loadcookie("loginkey")
9 A7 D- x5 {0 u2 k* @ 9 g; U/ R$ O4 q5 F) Z- s
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
5 P9 Y O1 H- S8 ^5 w: g1 J6 `8 }4 I/ B
M; X. B6 ~/ {! \. t//
; O1 Q# E: F: a& k( @
2 y* P* L6 a1 m/ ~# Ysdcms.go "login.asp?act=out"
- ~1 k! O7 t! d
# X o/ v: _7 N7 w8 F% Zexit sub
* ^+ G& n$ u$ ^# M% f ( K3 m$ N6 L( _
else# D- f) c, _; e' `- T, c
' x# Q1 W: z. \ p8 z; M5 Ldim data
" O! f! G' @/ Z; |6 S& } ' [- }- B" H- v; K& M" ^
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控7 S2 V" P! ^: b, x- C
* j; e4 }7 w. `9 a% q! Q
if ubound(data)<0 then9 l; B. q% o) G: n8 `3 J( Q$ A
/ g8 l9 _: v4 ~7 F# i
sdcms.go "login.asp?act=out"4 K+ N2 n+ q3 z$ @3 s3 |' W
$ d7 o- ?( h% [
exit sub7 n2 j% {2 |: @" H- c7 ?
/ U" c* D4 H& @ V- delse
0 i% Y2 O* `+ Y' L
! v$ z0 D5 u/ Z! N4 Dif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
! w8 q" T% h/ P, X. N4 \ h: _3 \1 Y! y, o
sdcms.go "login.asp?act=out"- V8 N6 Y7 k l: ]" a4 ^" _. @
; s( g1 H9 Y7 h- Jexit sub
3 q9 N! f: z( [3 Y& W
6 I8 }" g2 |+ w C8 ~' d L& Jelse
8 q; c0 d' e( Z* N " _3 C: V+ a9 t: Q2 Q9 q
adminid=data(0,0); X% _4 f( z& L
+ P/ F8 w; y; C# w& e8 \. a
adminname=data(1,0)
6 U4 P5 q5 @0 J! K- ^1 q
7 |0 Q6 _7 R% E! g: j+ Z3 ]admin_page_lever=data(5,0)
. s( K7 Y4 a$ M) K5 D% [
: ]' W) \# R* y6 n% d$ {& kadmin_cate_array=data(6,0)3 L. E) o; h& Z2 m7 P% i
! Y9 ^0 V7 [1 `3 L& q- K
admin_cate_lever=data(7,0)1 K3 ` A" A+ v# _. C$ G9 i
3 p$ \; |# L% g! h
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0( D! ]; j4 D7 X5 ]
! b' @* }3 U+ d% m8 ?if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=04 P, |! j; n! k
' O! B! J; O8 U3 O) h; `# r: h
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0, x0 c/ ?$ K' L
/ Y. e7 E. R: X9 ~if clng(admingroupid)<>0 then
5 W( K. r* b) ? * b0 P8 a# S; L2 v ^5 d
admin_lever_where=" and menuid in("&admin_page_lever&")"
% s' D: A% B( N; A* w! y
6 T" @* M; o* R- ^- n; {, i$ _0 iend if8 B# C( O3 p+ V
7 K* ~& |0 d B+ _2 P2 b
sdcms.setsession "adminid",adminid
" q+ J3 w7 L' o6 E+ n 1 _' v0 D) B7 n" p
sdcms.setsession "adminname",adminname) z! S# f! H" V" y
3 Q) Q. S0 Z9 s" Y6 m% o( ^; Osdcms.setsession "admingroupid",data(4,0)
4 F8 A) |# I0 r! o2 j8 z- B2 o8 v; x 8 x" @$ ~( b3 K9 b- ]3 F5 T* K" W
end if+ u: H% o$ t) D
: z+ T1 p* v: b
end if$ V* ]4 y% c/ v: l, l" w5 k: S
% Y7 _/ `. a6 X" I9 {8 v T
end if
! r! T9 w m( U. n2 ]. L+ b+ x, P; n / U" d* s1 R8 U) ], d& c' o+ n
else
* W; e$ P% y" i1 m- @) W& W! o * e% O. Q* j3 s
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")! y( \3 a. E, \" x) W
6 i& O) I+ f; g( D! e
if ubound(data)<0 then
8 x I' E) }- B- ?7 W 1 g4 c! ]' F" [7 a
sdcms.go "login.asp?act=out"
' F* Z3 u3 ]! m
- c1 U) R& e# I8 _exit sub
0 t9 |( R4 V2 b. l + p4 W5 x6 m1 r6 ^0 |0 F' }& o6 ~6 N
else% g- u: _; ^: u- g7 E3 @+ P
- l3 G; u$ Z* Q1 T6 ]% d
admin_page_lever=data(0,0)
" H& J& O- ~8 x* o' f" u5 F
% V' k k4 ?" ^- fadmin_cate_array=data(1,0)
f C: \" h+ P. K* u( L2 o8 v6 L
8 O' R; [+ z( ^, ?& B6 O1 l1 Vadmin_cate_lever=data(2,0)
, _' f0 b9 } h6 M* p8 _
( `4 Z# A5 z v. j8 tif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 W8 K8 P. t# [9 ]: B# d" r! }9 t2 M
9 n* g0 R. e) T! L! l$ Nif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
2 z% M: t7 s1 z& U" F ' {2 G) L2 f: j1 |! m
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0+ w8 X. B @+ |* S: I: V% ~+ C
4 q0 S+ {0 H) L* r0 gif clng(admingroupid)<>0 then
: N: U3 B& [' g* [% c
! V/ r/ c7 c4 B/ W7 Qadmin_lever_where=" and menuid in("&admin_page_lever&")"6 K: C7 s0 @8 ]
& f7 f! s% u o, @- G3 b3 I3 E( Z% q
end if% q- ?$ N1 e) P" u7 ]/ M
u, N: c$ C- d/ _$ [9 I- {end if6 g! ^7 Q ?# I n# z# T1 |% Q3 c) |
# w& m, `' r& {2 O P% ^end if
% R$ t- _- L, ` G% U( p$ ` 9 l( N4 U# M7 l: w6 W1 |
end sub# ]9 T/ j2 L5 K% M2 o, z( K! f& q4 ?' I
漏洞证明：
. `' A7 U R" ^: S3 r& e看看操作COOKIE的函数' h% p f1 G4 C3 ?9 }% `4 m8 z
7 t% a% m9 c1 O9 {1 d4 S [public function loadcookie(t0)
2 n2 u' k' U- F8 `, b$ U" \
i- w' d) G" ]& {* Y9 aloadcookie=request.cookies(prefix&t0)
5 G# v s. p3 u( L * Q; d/ u$ c- u1 H' @0 ^: e
end function9 ~ S5 K& F' s% ]$ t5 G9 f( [
/ ^' \2 \, ^; p- e1 A2 C! W# n1 v
public sub setcookie(byval t0,byval t1)" d8 L( \% h/ x- g; G: f
+ B7 I% ~1 ]" w, X
response.cookies(prefix&t0)=t1
; \( ?1 y7 g6 N, C
, f' e& C( t9 X) v) d8 T4 Iend sub
( j0 B7 N( x) ` a 7 l) D5 N; V: B, G' U; q) D5 B
prefix
* b- m. D) I; \8 P . k8 j( i8 O9 t2 Y( }
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
( k( ^1 }, E. i3 w! E
5 q4 {+ g& _6 k7 p( d$ bdim prefix3 W( E; T; K8 f% W/ \. z: I
2 r m7 j r @! C+ X ]prefix="1Jb8Ob"* T3 c l; F2 u( b9 s3 V* U
$ K) l9 R' r+ v% M$ y1 ]'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 ) U) N- w) p- b6 g( M# L& V
3 W" I3 \' `! g7 u. c) D7 Q5 Ysub out, n3 \, I$ j' T& ^2 {$ W# ]6 a
5 \; q9 x7 T& a
sdcms.setsession "adminid",""
, S8 g% o: C5 ]2 t* q# s6 U7 B" [6 k5 r
P& K9 n6 W& I5 F" K$ Lsdcms.setsession "adminname",""
# n5 i w( R4 z7 `
9 K7 k6 r3 T" `6 D" c8 Y) qsdcms.setsession "admingroupid",""
! h/ q, `; }) M' g. k: D* w+ H; r / x Q5 J/ U4 y( {7 t1 J
sdcms.setcookie "adminid",""8 X! {+ N- T8 q% j
9 G$ X( r5 S- a# k# A$ J9 v% g
sdcms.setcookie "loginkey",""% F' y" Y5 k3 r
+ x& `3 M" g$ ~! V9 o2 Csdcms.setcookie "islogin",""
" ~4 I) X$ e. l0 E' P& j
7 h6 m$ c1 P2 T4 u( m. Q- P5 `% zsdcms.go "login.asp"
. D6 [) @. |3 |3 y 9 t! W6 v9 h+ T, l* n
end sub
0 A, K& `1 w" i6 Y& y
" K# g. D4 s7 s( n 9 f. q& q; q6 O9 \) l" W/ ~
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！# L8 Y; w, t o
修复方案：
( L) Q7 u# c) i: j% A修改函数！
- }. ~, s4 g: g( I$ k$ a |
发表于 2013-7-26 12:42:43
收藏
支持
反对