要描述：
5 N& t) T8 m3 x3 E- R' f) O; ?% o" R" e" j; m2 D2 |- C4 p6 x
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
9 j- s& h Q$ L4 L0 i$ q i详细说明：+ ~9 i& y& Q s' y# t& z4 I7 k4 Z9 z
Islogin //判断登录的方法
\5 f0 k) d" Z
1 R( Y$ i6 u: Z4 f: p9 ~; bsub islogin()
" _9 _7 k( s2 h % d4 O8 ~. C8 x
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
" K3 i) m2 K1 B ] " s$ ?- A( g* a H$ U5 A) O9 p! u: h
dim t0,t1,t2
. y/ i0 a/ p3 W# J6 w6 e8 o
3 b: B* Y# I6 y. a; H: }) t% W( Bt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
; x0 \8 a% V+ Y3 m; ~
2 {8 @5 G' V8 k! {# `! W9 ut1=sdcms.loadcookie("islogin")' Y* q1 B3 D/ k# a8 O
" _8 z. {% l- T3 I: Q
t2=sdcms.loadcookie("loginkey")
% c* a6 ~; ?9 A0 |3 s! ` 3 g" v' k: ]/ X! E. ~7 F. D) ^
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行9 z3 a" @7 i" V5 V
9 r3 C& j1 O4 C4 D2 L1 B
//
: Z8 d0 k2 l% ]( f7 F : `4 T/ s& J1 b( y# M
sdcms.go "login.asp?act=out"
) V# i3 Q' B( F" _& L- l # `6 U2 ?) q6 P) J8 V' b6 f2 z
exit sub& u/ _2 ?8 q+ r& I0 M! v
+ g, N M( w5 _3 lelse
/ B! x$ [5 T+ p0 U
" N9 F& b4 W$ e$ B! ]dim data: C! W& m- P. |
9 L. i% e# m* t5 C8 Bdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控; p' i# @, p8 P
1 c$ }. S% }& J9 _: [4 wif ubound(data)<0 then6 I. h- W: H p9 }
! [5 u( E M5 T psdcms.go "login.asp?act=out"
4 _$ f# a. g) \) b " J" \7 j7 ^. F% n H$ a
exit sub
: A5 M7 J) ~$ {; } ' @! g: ~9 Q" [
else( h* b9 x' N& j Y; K6 D# X
# P% V& H. m6 qif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then' c* ?/ I C4 K. L# }- U5 M
3 J& K7 x3 ?! ~& ~
sdcms.go "login.asp?act=out"
. \: i5 e5 n& p4 G& D
. D' T( p* H0 c# d! K# v1 sexit sub
. H& s( `* J) s$ `, H
) ], x3 W5 t, I+ K9 aelse% q& T, C# w5 [+ k, K
$ G) l- r/ I: T8 v3 [adminid=data(0,0)+ B+ I/ R1 i7 W- v: L' t
6 s2 y1 Y* V+ V+ ^/ d3 @
adminname=data(1,0)
: ^* `) w0 D$ H$ C
- N: }6 A7 U' S: Sadmin_page_lever=data(5,0)$ j+ o' b1 r1 L) ^
+ t( {# R+ ^, E& O# ] Oadmin_cate_array=data(6,0)0 U0 Y+ U% o9 l
8 X+ P, t1 g$ i; q0 N
admin_cate_lever=data(7,0)
& B7 \$ C8 M9 O; Q: u 4 n6 ?% q4 Z" h4 }8 {/ P) a
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
6 y+ E% c4 t# S! b3 T 0 K9 L" Z% H" h; n3 }& \
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
6 d }' m, A$ h' P5 x$ x
7 y6 S2 M/ X9 A# a/ y5 R* V* Eif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
9 n$ y* a" W; z9 @( Z `
2 k: |6 u$ R/ I$ C, g; G9 e3 h8 vif clng(admingroupid)<>0 then+ @2 X2 Z( r* G8 _* }* M
2 ]% A. u# f& g; gadmin_lever_where=" and menuid in("&admin_page_lever&")"
+ V) g$ y } k+ f2 z( ~ 6 p. ?+ M4 S4 o9 _
end if1 E) Q7 }! E1 E3 v
. M! d. E4 V1 \' t, I" W2 |9 usdcms.setsession "adminid",adminid
8 m! v6 G% R7 Y
& q4 \& O4 o8 I0 |0 [2 \sdcms.setsession "adminname",adminname
$ j1 A \ f K9 C1 Y2 w' R
7 {. o9 y, e' n6 i, Z6 b1 Lsdcms.setsession "admingroupid",data(4,0)
# y% H1 M1 }* j; g1 w' Y
5 x5 z" t: Z- m9 O$ Lend if/ o& G& j. s- u( R% @
: I( {% A. `! z# B9 P" wend if
$ ^, k1 N! O" Z4 U! ]% r! | 0 r8 z* u& y8 w* H+ [
end if; T! P: P8 v8 V9 U3 E( n
+ t6 G( @- ~4 @. z, {
else
! Y7 i7 `: e4 f+ [- r, S l. \, `7 S! X+ O( g
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"",""). H% ]- S1 T b3 H9 s
/ G$ Z6 j! s* V4 L) \0 v' r
if ubound(data)<0 then
8 Q/ Q u! G/ S5 u- p+ f' ]5 F X+ b: P) ^8 k* A3 G
sdcms.go "login.asp?act=out"* R) Q) l# P) X
" P C4 I+ V# l5 ]! h' ~& m
exit sub8 S, I7 a8 I- Q7 s: l& I( k' F) D
) s, Q/ g/ r, s( f( kelse. q# a8 h U3 Y2 u3 w
( b, ^: O4 C v7 sadmin_page_lever=data(0,0)7 {1 _6 b& I4 b4 V
) e( B* t6 u H5 l! p2 J* iadmin_cate_array=data(1,0)
2 [6 a3 d; k; t1 Z7 s* w8 p 0 ^. A+ L7 f* D! z1 D. o( c% {
admin_cate_lever=data(2,0)
# F/ A( O1 P# }! m0 x
7 N& K* b& O: |if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
* y; ?( A# ^! M9 ^0 H3 `8 M3 q$ ^$ f* M # F) J5 _& k. a N3 @# ^5 f
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0- T Y9 a* P% q9 [; j0 x( V' S4 X* n4 ^
# e3 P( k; x1 Q1 O4 p- e; s+ D# gif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
; R6 B3 l7 M; L! I ' F2 v: H( u3 b2 W I$ B9 {, A. A
if clng(admingroupid)<>0 then0 L' J& P' k# ^2 }) G5 x/ N
) i: d8 u6 X# M! O2 n- ~* l: F
admin_lever_where=" and menuid in("&admin_page_lever&")"
; x0 N& p, r/ O z$ Y4 i( `# r& n! D
end if9 h( z, D" b6 M: Z
+ i4 m& w# W4 ^3 Y1 L. y
end if& C1 Q5 R$ C& m3 V! Q7 _" K
! u! M3 y, n$ b& h# E
end if: P7 H/ j% I" N- C7 }% v: ]
! F9 e7 Z) I" u" ~( R
end sub# r/ B; Q) Y& D3 i
漏洞证明：
$ e( m# R# C& X8 V6 W( ~% B! V7 w% S看看操作COOKIE的函数3 W! i' {7 q Q) X4 K+ O9 \
1 A, {7 K) j: A Z$ Bpublic function loadcookie(t0)* {/ n* A0 o& k
{; B, r: B9 \; X3 D5 kloadcookie=request.cookies(prefix&t0)
; p! Z9 m7 [2 N& i6 `( V5 q
7 i" s3 [0 D0 c- [- Q6 ^end function
$ N4 j7 K! A2 V4 R! Q % s6 V( |5 B9 j
public sub setcookie(byval t0,byval t1)1 n3 [6 w3 P6 t$ O; T: x' ]
6 L' J# P- f hresponse.cookies(prefix&t0)=t1
( r, z$ u3 |- C8 @
2 b6 m- C- c) ]; O$ p1 K$ w9 aend sub
Z1 P% l* P; _ 7 p' @! R9 x& m3 E1 B4 b! i7 a2 f
prefix3 R' @8 n" |% T* N1 J
; i) N* }1 |, f. o, z) b! B! T
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
' Y! t! Q% L/ ]& g) F 6 a, k F# r5 ^
dim prefix
+ x& n: X& A6 r q- c& _ 8 r, y- W/ b% N B
prefix="1Jb8Ob"
$ q$ G- J8 K# h ) }: T! z. j- a( t$ n3 r
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 & z$ a5 I0 s8 \) J! w
( E" X/ k/ m4 T7 }0 j5 K
sub out# f/ @6 T* ]. |$ _1 V; m
, a. F8 [, S+ Ksdcms.setsession "adminid",""/ X7 B% C8 M, L' p/ c+ R9 r
' B! X& _4 @2 \! n+ z/ C: }% T/ r3 a" e
sdcms.setsession "adminname",""1 r1 Z5 x2 c6 M6 b- |; ?
5 C( {/ I# `, S, W. I$ o- R) Nsdcms.setsession "admingroupid",""
. o8 Z+ |3 m) |3 D: y, y, L* c
4 k6 \. f) C! L+ K+ J: T9 `1 Gsdcms.setcookie "adminid",""
9 h, r ?. b# O0 l
' _: x9 S- ~! M$ _sdcms.setcookie "loginkey","": h# m0 a: D/ e. W1 ~& d# k( a) k
" F7 Z' d& H$ I7 P5 v: f Ssdcms.setcookie "islogin",""( F( e; y+ ~3 B, T: n* K s$ r
' ?. s& p, q8 m+ J- {8 G
sdcms.go "login.asp"+ v3 V1 Z: i/ M$ c s2 O" u2 J
2 k- [( ?' h5 W2 x- f& n. ^: G8 V
end sub
$ o- B6 z* P9 s+ B; u, G 5 M9 @) r! V! [+ [# {/ q
' l, v6 M r. y' R
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
9 y* N1 \. o9 J修复方案：
2 K$ U2 M% w+ Q修改函数！
y0 t) E3 w9 Q% Z; b$ b- r9 ]* \ |
发表于 2013-7-26 12:42:43
收藏
支持
反对