要描述：
) Y, F7 v* g# s: M8 l# K+ i; _: _) B: C! ^% @- L& a. E
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
' ^+ N0 I- N& Q6 c" M详细说明：
- c* W. c0 x7 y+ g) K$ f8 Q. {Islogin //判断登录的方法* W+ V: T/ _" R
' M ^4 m+ l: G) x5 I6 m
sub islogin()
: O# e' U4 ~/ G9 a7 R) a, s. o- I
; E# k) y# z% z% w0 dif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then ' i2 C5 i# I# z5 @1 r
% r) P; c; Q5 t `
dim t0,t1,t2
2 j# M/ @6 n ^/ ]8 ^ 9 S O; K7 f! H3 }- T
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie " t( ~. @! m3 A& _4 \& b
' r8 p6 }2 G1 ?! g) X; A
t1=sdcms.loadcookie("islogin")
; L& A- p8 o6 [% X; @4 F 3 L7 x1 X H6 C% m# k
t2=sdcms.loadcookie("loginkey")
: A2 C. ~/ ?4 Q% |/ y" J& m
5 z, h; F- Y: ]% iif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
$ z9 }/ N* y2 x4 m0 ^! G h& D3 K7 v2 d 3 F( I9 {. }, Y' w3 b, l3 U
//
1 E2 U0 h0 s# `$ ^ d% G# e5 @ . s [% U. F6 b# e! k' M9 T
sdcms.go "login.asp?act=out"- u7 `7 l c" N( R1 e
4 Z5 P2 x! @; @6 B6 P( X" Cexit sub4 @0 |( M. `( e: G1 Q1 O: ]
+ _$ Y; y7 x r+ |/ ]/ }else: h, v, T$ a7 b+ q; q) c9 {
* U x+ z- m$ ^# c4 Gdim data+ q& G5 h s0 e" S
/ S0 w5 \2 v" A! @5 K
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控) K2 M* o2 F& v2 S8 G% E0 o" S
- g/ ?1 ?& r; r" jif ubound(data)<0 then0 P9 @# M6 a l5 v
$ v# E6 z- O! d" G k4 G& J" q6 }+ ~sdcms.go "login.asp?act=out"
( ^1 o) R8 @* `, D0 J# Q$ y* P& }) ?
! W# Y. |$ |) m; o/ G, ^exit sub/ L4 P8 I6 k: B
9 |7 X6 X% w& i9 ]# d( v
else
z& c1 b9 P5 P2 H7 t! o
7 y# A$ h! A: T7 A- b- Oif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then* F q: |0 X( F ]$ Y
5 v0 t+ O8 n- ^6 Vsdcms.go "login.asp?act=out"
( u: Q& a8 }7 H 0 t' f8 L b* M
exit sub+ }6 S6 ]" e! O" e: [
6 E V: l; t5 I7 y: {% I$ q& ~1 }% Celse( U8 s% _; k5 Q
- ^* S3 A2 j) X8 n- e
adminid=data(0,0)
- o6 g8 n4 ^1 d3 Q; }* T
7 f, _" ~" B3 A @' Vadminname=data(1,0)
3 E4 Z) `4 k& d/ Q0 ?5 V6 S$ u
: R, N# W4 n3 t- T( w1 b$ C' K% Padmin_page_lever=data(5,0)2 {. Y# z0 G$ W# P
* ^2 J" z. x7 k5 r# w& e8 s" `admin_cate_array=data(6,0)& M- k& D2 W8 G
. F! p# e! z( q' Q
admin_cate_lever=data(7,0)
2 V+ a8 g" ~7 d! l
s( |" \# O( `/ f# oif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
8 ?- M. _) p0 Y& E* ]( a2 J$ v
9 t1 q3 {' j2 W4 r4 J) L% `if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0# R. N$ v4 @7 i9 {' M+ ^& R
* H8 }* u5 V, I0 @6 V
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=04 B0 n n2 C/ M/ R0 G1 H# T: d3 z
% M: Y6 j8 s0 M6 F* cif clng(admingroupid)<>0 then: x+ w# l- v& J2 A2 i3 q
3 I: D' _* \- x p4 Fadmin_lever_where=" and menuid in("&admin_page_lever&")"
9 L$ @; `5 X' ~, |1 T3 o: ^, D* Z" ` 5 I+ t+ q+ A: D; k
end if3 h! ^; y" [# y) D3 s% f) c% ~# ?
! a Z' C' z* I4 n, fsdcms.setsession "adminid",adminid
. s& ], G j" v0 q& y- O8 }, c ( {- t/ P) X' O( N# ^
sdcms.setsession "adminname",adminname
2 I; S" N& f2 f2 f: D% A - [. @/ @+ d% y7 l; K# s, m9 w
sdcms.setsession "admingroupid",data(4,0)/ _/ m3 Y. J+ D5 p
/ S* S# O& ?7 u* a" Mend if" q8 `2 s0 }( a+ P# E: D' z
* z g0 y* ]& @- M4 |9 e' W9 R/ Cend if
0 i% W- d0 l/ A1 p4 k8 F" D 7 Y) J. n. }$ X( `8 P
end if
) l: h% v& n9 @: Z+ G. o& \ 5 O3 K- U# @1 x0 ^; m
else
" f' z3 t$ D$ s- l ' Q( Y' m8 _3 [7 _0 B' n
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
' c d- R- ]7 h8 F! o; | 0 Q+ h8 ]! Q. y! y9 {: [! J
if ubound(data)<0 then# \3 [. M4 M( N7 M
: u3 |: W* k" ?; }% S0 @+ nsdcms.go "login.asp?act=out"8 d. m1 y1 R0 ?" a2 `7 ~4 ]' K
# [) l/ g1 J% F$ J3 o/ i g; vexit sub* q: S( [0 q. v
4 n7 `1 X4 c. E, [7 w
else+ z8 r: L& _2 p" J4 p) Z
$ F! B o7 k. q0 `: h0 v# z
admin_page_lever=data(0,0)
# {* j7 p+ \- i5 r! F & a2 g. h! r3 ^/ M. c
admin_cate_array=data(1,0)
' } k% V" X) A- t
q( A9 X% }3 `. jadmin_cate_lever=data(2,0)
6 o( h. K7 a; T" Q5 @
/ | @2 i# X/ ^' R6 U5 pif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
! }, I6 F" O2 ?7 O* b$ z ) ^7 |% W/ G2 y
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=07 ~5 L) {/ i9 k! O; F2 S
. K) @! j* _8 |- Y& |
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ E) E2 @' B+ s# e 8 t& I$ U) U4 l R Q* e! h
if clng(admingroupid)<>0 then! r" i; W' |. h, k5 i3 Y% w4 f
) q5 T: Y& y" k/ J
admin_lever_where=" and menuid in("&admin_page_lever&")"
+ G; w7 ]& w. n : o- l V1 b1 f4 V8 X6 h- s8 A9 m& Q
end if8 z7 [6 n3 o5 F
" z+ f# e. O8 Y/ `6 v/ T
end if
2 ~- q+ S* g3 r4 B; ~ + i7 F4 }+ @$ O* ?2 D
end if
! h: h' {" ]8 o1 l
9 v( R3 l# r! ~7 g9 r# c$ pend sub
, V/ x! k/ D, |" G% @2 j; W漏洞证明：5 ]# Z- [6 T5 @3 m6 s) Q
看看操作COOKIE的函数; T; `6 \# ~. F% J! ]* p
% l# O9 d8 x$ z8 _" |. {" N, q
public function loadcookie(t0)
' r9 f* r4 D1 c' |1 z- h% N+ J
% z6 Y/ B. X! A0 r7 sloadcookie=request.cookies(prefix&t0) u4 |/ F0 _9 m" x9 {* L
& m* C* r* w$ _/ _end function
, U8 _0 y& G/ L) c3 n+ L ) |3 B; ], L0 W" P- b
public sub setcookie(byval t0,byval t1)2 S5 c: e' `4 A
( h2 P a' d6 |
response.cookies(prefix&t0)=t16 q2 ]/ b p, o& Y7 c
7 |: D2 [$ z0 I9 h1 L8 X+ |% v
end sub
, J0 R2 ?& {& T/ ?4 F9 r ! C5 n, `& S, K9 a% U# y( s/ _
prefix# W9 C( q8 g8 [7 Y! { V
# K4 M- F* v. |* K'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值1 h# y- [5 C) Q' t
; S( E/ h y: I* a! |dim prefix% Y, z1 R$ @: e5 S3 T
0 F+ B' ~! t, C- M, } x& z
prefix="1Jb8Ob"
9 c: i% J8 t/ N/ j# k8 H% z$ H- |" ?
* W L7 }/ a) ^0 _5 F' \'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 ' c+ \, W$ N- e
8 ^# {- i* z& }1 v, hsub out
- ], m4 ^8 N8 {" z) \- I 6 c$ X8 H& L( e3 t6 T/ B" ]" N% d
sdcms.setsession "adminid",""& g+ G: a/ q; ?8 O& K6 _0 i; B
& \* k0 B* [8 y5 B/ P
sdcms.setsession "adminname",""
, J4 Z: ^) ^ l" s& n( b
2 P. k, @; r6 P# C) I# D0 Usdcms.setsession "admingroupid",""7 l( x& s. o4 f3 H4 v8 H5 z
9 k8 i6 @ I/ z4 m4 U" Hsdcms.setcookie "adminid",""
7 ?9 q! U. C* q- ]" B* R
6 r4 \* C: O9 X r0 ssdcms.setcookie "loginkey",""" `1 A% R5 y1 k- I3 x
9 x5 z( l3 [4 z9 Q) L7 Csdcms.setcookie "islogin",""
, C" f2 X' A7 K; l! T, j, n( f' D
1 b" x' {+ y# @1 M2 L& g; ?5 fsdcms.go "login.asp"
4 A/ s: s' @ G, C, ?
; _9 w6 K# j) {. u* {; P t1 Gend sub
# g, L; R4 [& i
$ x; a" R7 A% f3 N4 ~7 f 3 L8 _% d4 O% F' H3 N% ]' X
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
+ j* T7 w- g; v# T" O' [' p修复方案：
0 k9 S9 m6 A. ^) {. Y/ Y G1 d' f修改函数！
* O- t+ h* O# w* ^ |
发表于 2013-7-26 12:42:43
收藏
支持
反对