要描述： a1 i* X4 d, w( M, ]6 e
. ?8 L; V# `# I' M2 T+ hSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试1 P) R6 {1 U/ b! I: }
详细说明：, K @' u- g, T. T8 t
Islogin //判断登录的方法
5 i( N1 b! y, `+ f7 O; B
; g. u' n0 c" H* ysub islogin()% N+ `# ^* ?4 u
$ |$ H6 o; [- d' j! Vif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then + ]& H0 @# V* e( i
1 y2 P @) `, m" I3 g1 R; q
dim t0,t1,t2
& h5 p4 d: C& z* @
5 I6 O4 y9 q8 O& n* U" s kt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie " v2 G# s2 ~; K4 g @/ c
8 \% l$ c4 B, e) j) `: s2 E
t1=sdcms.loadcookie("islogin")3 a" g; G1 `! F4 [0 u
7 _3 Y. I& E5 D2 ^+ s
t2=sdcms.loadcookie("loginkey")$ V4 S; M$ y7 Z: j
& d1 q+ V1 K$ P: @/ Dif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
" R4 a+ }, `, C& \' b& B' I
' Y6 h8 ~( F {! z//: `$ |$ k) G) o9 r! [, h
) }, i& j! \9 B3 ^9 ]6 H
sdcms.go "login.asp?act=out"
3 \ K, T/ J4 z% y8 y 8 c. u9 _* n' e$ k
exit sub+ K" Q S( } {& E
2 W3 ^: R8 C# D0 P( A& `else9 o* Y- }. h% \8 t* A
) Q4 x8 \/ [8 {4 |: S6 ^
dim data
4 L! ~* n& A1 }5 G3 X; c / e! e/ ~/ t7 T' R8 C) R
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
! o( ~" g: u% A5 j3 `6 P8 p& P
N0 g2 ]3 e7 d1 s3 n& Y+ Cif ubound(data)<0 then$ t$ i+ I, L* o& | k
& q; N+ @8 ?/ P# ]sdcms.go "login.asp?act=out"
* W `: `6 k. F# T2 G
3 Y- V* U7 K6 R! }) U9 {$ J. qexit sub, m& A, n4 b- C' @ U9 ^
n. r0 o( v) r* E
else
" I/ M$ x0 i3 |% _
8 F8 u' M+ d+ A8 q# [if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
- ]( z! F2 y# y! Y 9 ~' _/ z) R( s! A
sdcms.go "login.asp?act=out"
, u7 G* K# G- p4 M9 K + _* W3 n' f& b Q: I$ ]: Q
exit sub
4 v! w6 b/ p' x M+ U2 M7 Q
) b: I; ^5 ?) Y3 ~" Relse7 t4 n$ e1 S1 d" {) J8 T* W) n
+ ]. s1 A- S0 Z8 l+ D ], \# s& W7 Wadminid=data(0,0)
- x# n' y2 d8 N- k; i& e + d5 Z' J/ C6 @! ?- q7 b M% \
adminname=data(1,0)
- a6 [" b1 G6 D
6 S4 x4 w4 V0 Y- b" J* f3 p uadmin_page_lever=data(5,0)/ B: |1 l1 [# v
; M# _* B. J3 Y" H; w' X! Radmin_cate_array=data(6,0); j7 `3 i: n2 y) J8 i
+ B- u( F+ w! x5 }- d( r$ Dadmin_cate_lever=data(7,0)
' b$ |7 ]) g; Q3 l
+ ^& Z# k9 O% L; ^% P1 d! _if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0" K7 B! }) A2 k$ I u
1 n, _7 v) w) d9 O1 e% T+ Vif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
6 O) j Q: R/ b8 m
# T, |5 \( l9 j2 u0 _& f1 {" rif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ J4 z3 W" R( N! Y$ Y
% y8 R6 r8 X- \4 `7 n; m7 u3 K: gif clng(admingroupid)<>0 then" D) D' B ~9 A$ _6 M9 k. Z
- O4 }! b3 [6 n% Fadmin_lever_where=" and menuid in("&admin_page_lever&")"% S4 l m0 S( T
4 K( ^$ c9 _6 `% l# |7 W+ O
end if
0 H, K; Y% H3 Q4 ^0 D s3 o$ e4 i6 f$ ~
sdcms.setsession "adminid",adminid! Q" `/ \0 M. V: N% I2 | z F
+ s6 H& _; {1 m+ T- [% usdcms.setsession "adminname",adminname4 x9 p1 d: S+ J3 l: i2 x
$ A7 C) F6 I1 \+ M9 V. N% d) M( A8 f' lsdcms.setsession "admingroupid",data(4,0)3 S8 r6 u9 Q, _- y
, c+ }; ]& F+ h* a6 ?1 m+ l0 o/ Pend if) }% K* i3 s& e1 M+ d
# u" G1 X% S3 |. q9 \7 s1 C# n
end if
- t$ P/ X w- U" M) w7 x
1 _' T4 p. d* rend if
) w$ H$ v+ p! X9 N" g
3 j- F' o# V1 s3 F7 [- y( P* l9 delse
" M5 `5 e. A6 s7 k 9 D, e0 X) `7 h. j- \0 W
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
" E' ?9 \/ N: m/ ^$ l * t% G7 S* | p/ C0 i4 S% Z. f# e
if ubound(data)<0 then
. n3 q; n8 X8 B5 v
6 @3 p, O, K+ _5 _9 L& Jsdcms.go "login.asp?act=out"
5 X6 V6 F9 T2 K' e: `. B ( U. \9 ~- j5 A- D# Y5 r; ?
exit sub: w: {4 S7 S, _
; T, B# B9 U! lelse
# ?8 W) n( C# u3 l( z `
5 E7 i1 e' r+ d& M6 I( A* {admin_page_lever=data(0,0). p# r/ r- G" D* a
" A( [! f; Q1 y- Eadmin_cate_array=data(1,0)! x* T2 c/ U* e' d* L- u) J% V
0 Q9 v" ]2 P9 jadmin_cate_lever=data(2,0)5 t5 ?" [6 e9 O% e# p' I
?1 N1 _7 J) X& {/ e
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=00 t8 [1 A& }, E5 ^* J6 i
_+ p( _8 K: k# |# [; }7 }! Q
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0+ y2 p4 J$ c* o; ~
7 G3 N9 r' {7 R' D" wif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=07 |# B; v7 U/ r) ^5 o8 `
: T* s; t( D9 k4 Z3 o1 _ {/ rif clng(admingroupid)<>0 then
7 q$ M9 s7 p" e6 q0 r & @5 a) j0 y1 w% R7 S
admin_lever_where=" and menuid in("&admin_page_lever&")"8 \1 \, n# \/ e R5 q
: P5 F: ~ z4 j4 F) G# |end if
# }7 o. _) Q- R . C: I* B) Q+ q1 f: p) S- Y+ B
end if* c' ]4 W9 E; O
! ^: B% b( v7 w6 a4 G) r& r* b9 b
end if
6 l* ]7 l& b; x9 i
! i. r( k: K5 N7 gend sub' h, b4 k E! Y2 S' H- {$ x7 j
漏洞证明：. j3 K. R d; \: E2 n4 ~
看看操作COOKIE的函数8 p. v* i- Y, L; z/ N4 W
) x' t- L. ^5 T* @3 O9 m' F# c+ K' |
public function loadcookie(t0); x, x& Q9 b6 }* h
1 P$ ^+ k3 w- w7 F
loadcookie=request.cookies(prefix&t0)
" j# _; h% K7 Y8 t4 [; h 4 z3 Y* i1 o3 _. A( O
end function! |+ m0 E1 a7 f3 v) `# k
; y2 `6 v/ }3 z" E, ypublic sub setcookie(byval t0,byval t1)3 O! K" |+ N9 j8 L4 I# o9 I
8 b; t. O' k0 T- {4 Z. }) \( h0 uresponse.cookies(prefix&t0)=t1
3 G+ o& t2 X) U) d4 q. z' Z 9 j- c9 ?% j" F& h# v# `* _
end sub
! A' F2 h3 k& P( v 5 i& @! i* F- `2 D, I- i- F& E
prefix; I4 h% H" X; e. h
7 ^2 B9 g3 M- S: j'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
( H3 ~( t. b9 u% `* }1 D
9 k! j5 n; o" n1 Kdim prefix
+ I1 C" \8 R( p, ]
) A" V. ^, ?: X+ Y, I' h4 l& Eprefix="1Jb8Ob"3 |; {) l5 ` T4 Z
5 s0 Y7 l; C% @) T' Q, @'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
\/ s P$ j1 X7 Y ; X! `/ |5 @6 l
sub out
b" M% y M& K) C. U: {: Z: B; } 1 @2 g; \: v: _+ m7 W
sdcms.setsession "adminid",""
. U2 I0 f+ n6 h3 m/ h
G+ T9 }8 H* Z$ i( j1 ksdcms.setsession "adminname","". `8 n" E1 z1 T5 N M6 Q4 K. G! M
1 a) N$ u6 d2 asdcms.setsession "admingroupid",""+ B; T$ g9 K3 z6 m8 O9 x5 S
* c% w( T) d4 A; n7 S. tsdcms.setcookie "adminid",""
9 \1 a1 I/ Q+ i' R8 e
S4 o& H2 p; P; Wsdcms.setcookie "loginkey",""
4 @; E& G% b# ~5 u& y
% z. k- w; D; g7 G( Msdcms.setcookie "islogin",""
" o1 _3 o) z7 T 8 X# g, }# K" @# D7 l( C. S
sdcms.go "login.asp"
n4 Q$ E: T6 j# m2 {7 m ' F- `. {, T* P0 r$ K5 ], ^3 s
end sub
0 Z! c; f4 H+ n. e1 `/ N0 ? 1 g4 r, E) y6 _! ~* N5 g
$ W* h( ~4 _3 f" p& O: Q2 d利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
9 g6 f: ]. W- o. N9 ~修复方案：
' X5 k. a0 o! x+ \4 G' |" ?4 E& t修改函数！9 [6 W! B3 J* k/ G' ^1 \
|
发表于 2013-7-26 12:42:43
收藏
支持
反对