要描述：( g o! g) ?+ m7 D" D
1 K) s5 O# Q( Q$ @6 h5 p
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
/ K- v1 b( ?. z! F; C; Q详细说明：
1 i- W$ f6 ]3 Q5 _. bIslogin //判断登录的方法
# }: G8 j& h- b4 z7 M$ R8 A. F
9 f$ I- ` U5 w6 a- ^8 A5 ^sub islogin()8 } ^+ ~; @+ s. s9 K- v8 D
/ N$ e& W/ y. F8 j8 F* w1 e
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
9 k/ l* R- k; _- b1 j- @ " } k* L' ^% Q5 P2 `! ]6 r
dim t0,t1,t2 , {1 t; u6 }. W9 M' R0 j, ]
1 U* O+ i7 z/ C8 ^) }t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
9 H! b3 Y. ^4 i
) L; d3 ]5 w. L: z2 {) ut1=sdcms.loadcookie("islogin")* Z4 N; ^0 m& t6 q4 O3 F6 ]4 _
# U K; \% L) o. q. @t2=sdcms.loadcookie("loginkey")+ ?/ L) c% w7 F+ E, D
8 `# q+ H! T! E1 h& q9 _0 [: t3 Dif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行3 d1 e. u U# [1 O
' k( I3 r! m8 ?% P
//; S5 p: r8 f* P% j
% a, B- H i: l
sdcms.go "login.asp?act=out". X B2 f( j: D( c! W
8 L% b" h( ~/ S& j4 |' }9 J
exit sub! ~. o% p/ F8 O" \# h8 f o
* R! w- I4 X' T, r7 telse
9 u! u" j0 F+ ]$ X* l$ p! l 6 Q2 W! m# p9 h4 n2 Z7 C) k
dim data$ n' O. Q# d& ^3 g1 T: S1 _
0 T& ]+ T- h$ o& |' q+ kdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控/ k: D* V- y: F8 O! N
1 x' E7 c, o, W3 v5 R0 h0 W
if ubound(data)<0 then
; I! c0 ^; N y2 p$ O
' x, v$ U; s+ @8 A) m9 E' xsdcms.go "login.asp?act=out"
0 x& l0 q6 _- P: i3 E: J& x! n) p , P* e0 {% N( r" ~1 a
exit sub
M$ L& {$ R6 K$ E
, {; Z( I3 a0 [/ N, @5 a9 Welse9 Z$ a8 P; g3 k/ b3 v" W
: D! E& i: B5 G* z. x9 Y" |
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
9 X+ e4 y* r5 D, U! F- g
0 Q! v- U) Y" A# W5 wsdcms.go "login.asp?act=out". s3 x& n7 f( ?7 `" v
/ ]% J7 X- l. `/ i- w
exit sub# j4 ~/ x, I( \: I: j; z0 l
- `& d3 M+ `! \5 Eelse; K& k W$ y+ s5 t/ \/ t
. E; R! N' M4 X" ^
adminid=data(0,0); f' p* S0 V) X3 T1 w* [1 x
7 J& b" w( o! fadminname=data(1,0)
2 z6 R ~& L# S( b0 j- K
+ M; B* L- ^3 padmin_page_lever=data(5,0)( |& |8 B7 W& N, {& q; Y. u& d
/ f) N$ @1 e) i' M/ {
admin_cate_array=data(6,0)4 b; Q) }& c, R
# O, B9 S; z' D& d9 g% P6 [
admin_cate_lever=data(7,0)
1 w' u5 j `' O% m- `; |3 F( r ! [5 P, ?9 z5 e; h
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
$ w. z" h6 b. W
2 S& ^9 |$ X- ^5 v( ~8 n1 sif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=04 s/ g' Y* M! j( G
$ z/ E' c3 P! V# t
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
, {" M0 k& n \* l" x& D 3 W+ k; t1 U o3 n' b5 Y/ _
if clng(admingroupid)<>0 then: K8 s0 a+ @$ w+ p7 ~
% M4 m4 J/ r) u8 B5 J
admin_lever_where=" and menuid in("&admin_page_lever&")": E+ R* h! y# v1 b9 `
* g; Z4 M, }2 r' O' t2 c5 |end if% m) J$ U" b; P! O, |
& D( I6 Y* P; Z9 _. R
sdcms.setsession "adminid",adminid8 F+ @2 {1 f$ ]+ l' F! Q
( W( z/ w, L K6 ?9 A2 v& X% M) E& isdcms.setsession "adminname",adminname$ a' l3 k! B$ f" N! v
; M5 t# ]* ~" H: z9 F
sdcms.setsession "admingroupid",data(4,0)
9 M( a6 {' J! w6 t* [
& W6 e& N- g! ]5 kend if: s: w; b4 y% ^7 S
" [8 O5 Q5 o8 A3 s8 F: @7 I
end if
f0 i8 s/ V# M7 H$ q
# Y R7 x: L' Uend if
2 Q5 \* x# Z2 V/ z }
/ y L% Y i: P! D4 G welse* K4 v" k3 t# z" w
% j& Z" y, V( g& x ?+ I( F0 O
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
6 `. t5 |9 `" u. ~6 n( e
" W6 x# O1 v7 j& Uif ubound(data)<0 then2 d" b9 }5 f/ V
0 v6 x3 ~# u W5 E! L) ]
sdcms.go "login.asp?act=out"
0 Y b* h! h& s0 b# S- E$ |( I& ` / \3 s& @. B6 X6 m
exit sub
# N8 u+ Y: s, X# n+ u6 K9 Z
: _, l- V1 M! i" Y' H3 Yelse
3 u& ]7 M( \4 g; L) d+ ^0 r + f. a6 ]+ P* E9 E ~
admin_page_lever=data(0,0)4 K5 t" E2 c `+ X) ?) S
4 o7 G5 k a; \( b/ Z% b
admin_cate_array=data(1,0); l4 N! K$ R1 v; v5 J3 Z
& L4 P* n. d- W: X$ I
admin_cate_lever=data(2,0)0 W" p: ]4 R# |( I
" [% }! ]; P' \ @) G& R H7 E+ ]if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ i7 V' ]- H' i% n2 }+ d" {1 x ' M7 I* |6 I6 i- S
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0" j) Y: @+ `* l5 S
8 w8 W8 A& V- n' s' M$ S% S2 g
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
/ F& M* u6 v+ P% }1 ~ 8 Q# K, Z4 M) u
if clng(admingroupid)<>0 then
# k9 I6 `) o8 V7 L/ {1 l: X6 t& D3 T+ L
. c6 O3 c: M: }admin_lever_where=" and menuid in("&admin_page_lever&")"
) a/ U( C, y5 g! D. P/ ?6 f
1 ]7 W2 ]( f3 P5 a( H4 Aend if& N E. w, i/ y- u- c
* y- j# j7 O* `6 f; g8 i! U
end if/ t Z5 b: J' V# P
# G* h }5 G& H$ a' ?2 Xend if! ^& v+ U; W' ~% ?" z; [! e( u8 u
' M( |" Z- q4 c# i$ S, n( K, x' R: j5 xend sub
: q: X6 c- _. g# S3 M h漏洞证明：! R" M% C# ?* ^( b; r- k
看看操作COOKIE的函数
% b& ?! D# R9 s4 ~; M
! c! k, _3 a" S9 s' G7 zpublic function loadcookie(t0)! f. ] I3 q7 f" \! r5 _/ m
$ ?+ ]: K- c! c
loadcookie=request.cookies(prefix&t0)
: t3 y& R$ P% M 0 K) g' U0 o9 l9 W9 y B
end function
6 o2 B" e( a2 l% N K% `2 c) e. H: Q9 q- U
public sub setcookie(byval t0,byval t1)* Q/ G/ W Y) [( b/ a: u
% \" D. p8 A/ J E8 s4 i+ E! z/ N, t
response.cookies(prefix&t0)=t1* R! T! D/ y5 d# ]9 `8 M+ X
5 D# }& W5 X1 t
end sub
& v7 s- u4 M9 f: u* C$ @' W+ |2 N) o
: S9 d$ C& s- S9 F" X2 }! ~2 Rprefix
) f, p( p2 O- U" R, e! H. d9 H * }9 b y: W$ d9 v
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
9 n2 d' K; _& c ; H: F* l4 V: J1 J H! [6 ~% _ U
dim prefix
4 O! q3 t% p5 n) b ; |, ?3 t- T" {2 F8 t' x
prefix="1Jb8Ob"
+ @( R/ S7 `7 F
, {$ D, Y7 h5 |! z" `'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 $ Q( ]$ c$ p% P1 X. u }# p/ R
: [. W7 d0 X) t2 t7 Usub out' ^/ w$ ~, V( k) {7 J+ h
) o* q1 m+ ?/ i
sdcms.setsession "adminid",""5 B+ t1 B' C8 @ O4 q7 J2 A; \
3 a/ Y6 y6 Q* C- D& Esdcms.setsession "adminname",""
, z8 y3 }: R' n! h8 l 1 V w4 I/ I; g' w! ^
sdcms.setsession "admingroupid",""
6 U4 n. \6 j4 G6 F Z6 A* |& R 4 R& a$ J+ r; M) P
sdcms.setcookie "adminid",""
; z1 |# @8 j1 A1 R0 Y' r ( v* H7 Q: l8 C% C9 L" d( s' p
sdcms.setcookie "loginkey",""$ D1 V: w7 v3 d0 x( S
6 L" X; t' f! W9 m( q+ D' B+ v: R/ a, ]' Nsdcms.setcookie "islogin",""- K5 D x7 x( g# t/ x: x
: K1 X- T& `( X7 U Isdcms.go "login.asp"
5 Y$ R2 Z5 g/ A6 W
! c7 G, \0 C/ `# j0 Dend sub* P: @1 X& X/ U& E6 t6 u5 `* ?
% B' W# |# N2 `: W5 u( I% [ ' p7 b3 x0 n$ G, p/ w
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
6 p. }3 a+ D; T }1 Z$ Q修复方案：
2 E6 \8 }% u6 Y1 a6 e! P修改函数！
( g% Z) b! b0 T! Z8 L |
发表于 2013-7-26 12:42:43
收藏
支持
反对