要描述：
; _5 ^& o; |4 x7 t2 ]+ U H3 s' R/ W3 L% K
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试' U) n$ [" }9 z! O
详细说明：
. h1 e/ A/ P% `3 `- `. J. E* H) m9 iIslogin //判断登录的方法
3 Y# \8 D/ z, z% u+ c+ e2 s, F7 ? , F' A; W6 D7 h; t* F/ H
sub islogin()
5 i* z& i" a2 |- [& C; [, T0 P
& F" Z6 a6 ~" F7 J- _if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
& R+ i: f1 \& t$ y
* c: v! b% d0 T( o3 kdim t0,t1,t2
' o$ H; B* b* ]" k% l ( m7 M7 p: w% _- g5 D
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
* A# N7 E! j1 k z9 `7 I; W" k# N ( b) S* ?0 p/ M
t1=sdcms.loadcookie("islogin")% z/ e1 O H) ~: {% z
" ?0 M5 L& {$ h& G5 x9 q2 Y( W1 B
t2=sdcms.loadcookie("loginkey")
Z: U8 _) h: H, f
5 a' i1 {* t8 j' Iif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行6 K: I" v' H# {: u
9 }8 H# c, j& E& o//
$ M, ]1 O6 L& ]% h
& d- T' ~+ w3 p' t4 [) t6 x) R' u% vsdcms.go "login.asp?act=out"
( G9 |5 \* t& Z3 V2 k 6 Q. R- t9 G l! H' B: I
exit sub- o' z. {, F. _7 O: v# ~* w
8 r6 h' L8 d a& n7 }% q
else" V9 ]+ M8 i1 S1 p+ T
1 k0 A8 Q: D2 u0 zdim data6 [4 x* n9 w8 O- n1 D( r" [
9 }* F( n4 q( @' [2 Z( Zdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控( ?. l6 l- c) H% s% c
/ t' D# A; E2 e1 k; m1 _9 Y5 m
if ubound(data)<0 then
7 B7 f6 }) b; h6 z
& @$ }. [8 A' e$ E3 ` lsdcms.go "login.asp?act=out"
! {+ w6 f: V9 Z! o
2 t3 {8 \$ Q" [1 `exit sub8 N& e/ ?7 t9 C3 h' w1 ], E- K
5 n1 G3 Z [- n6 E
else
& T3 \* O' @6 g1 v & p( E2 c4 O& c* e w3 v
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
* t) Q! H9 ^7 w/ J* y; Y" ^
3 p- D: |1 n4 G/ C7 _# [6 Z# N% gsdcms.go "login.asp?act=out"- Y& }% H* f3 h" |1 |. H$ W
, t, H P ]) J$ {7 p' _9 t' Rexit sub J$ [1 a4 U" a- ?% U* D
, E" x7 d6 ?8 N" c5 d; V/ I! A
else) C! L; H! X7 w' F; s! D P/ A0 U) H
, Y7 f2 B2 `2 j0 y( E+ eadminid=data(0,0)
. t# Q+ X* P7 u
! v1 F8 P8 Z% o0 {" v0 M( aadminname=data(1,0)
+ v0 T% K9 Z1 S$ o % U1 C( f+ g! H
admin_page_lever=data(5,0)3 N( ~+ R- I0 K& m. I
& p M( X6 k+ S, l6 F+ N+ Kadmin_cate_array=data(6,0)7 g5 x4 b0 x) @( h3 A" g6 {! i
/ m: b3 ?8 { v7 `( E% T# V
admin_cate_lever=data(7,0)
2 g( T- E9 ~* F; X8 W
4 G0 B! s' x5 wif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=03 Y! e9 S, ~$ F; q6 t* ]
. }0 q' B+ o7 ?/ Uif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0( O7 `9 _ Z, P4 k7 Z
7 j- F/ g0 ~6 n+ K1 Zif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
) r$ k$ A. m3 R, E% W # N; O. `, z# o# \- n @
if clng(admingroupid)<>0 then
1 u3 D% I5 ?5 N z2 z) e ! S7 J- L) s2 s8 Y8 X: u) A
admin_lever_where=" and menuid in("&admin_page_lever&")"
' {7 |2 T2 V: b5 I$ J / m3 H8 C6 U$ ^" e8 ?( E* e
end if
1 F6 f% d# K8 m6 Q6 H0 g* U& Y 2 {% k* Y# o' D5 v
sdcms.setsession "adminid",adminid! Y8 q1 I: c% G, X$ E1 X" Z
) H4 r. o% Q: [: m5 E
sdcms.setsession "adminname",adminname* q1 [4 Z' {2 w
6 b% y2 F' \! a% T9 ^sdcms.setsession "admingroupid",data(4,0)2 }/ ^( E8 e% A( H$ W
6 {4 I( P( `1 T2 I( B! G
end if2 G; i' C1 n% ~) j7 q
' \ D' ]7 J3 }- ?2 rend if7 U2 i) q* W+ ~1 ~# {* @; d# m
1 {, V+ a- j, J* ?- F1 E/ V2 Uend if
/ f' |* H4 b2 C( n8 c0 _% o2 x5 I
) H6 H5 u3 z7 d- f6 X* Nelse5 o) x$ [, B) o, k, Q* ]
2 x' k# ^9 ^7 C9 Y& M) E
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
) N: Q3 i3 l5 M3 ~1 j5 A3 ]3 H 6 r5 R' m% p8 P$ u$ d. ` T2 a$ {
if ubound(data)<0 then7 a6 e4 B% s8 b1 u
9 r0 [/ y3 [" b
sdcms.go "login.asp?act=out"- O7 V5 p: g* g L. n
) w: W: d. b3 q( d9 P- f
exit sub
) L( B% k4 @4 B% _) u - e0 V/ ^0 m2 u/ F2 a
else
# s' h' |& x% v1 J: I
2 B9 E, F6 _$ c1 cadmin_page_lever=data(0,0)9 o! T2 g6 w& s. M6 z ?
; n9 O* t1 B! x3 L [
admin_cate_array=data(1,0)
0 [0 w1 F( x! T: U % x9 y+ U! [ n* M% b
admin_cate_lever=data(2,0)5 |( p7 s0 l' n8 N1 U( F
' p3 J& q1 S- T( ?( J. N3 h
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=05 h1 y: ]9 X6 l" q4 C
& V3 y" a' T0 g1 I# a8 C" Q! D& y2 Rif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=05 q- B8 j$ o5 z$ P
: Y. Y7 |3 K1 t1 q1 Qif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=09 H; O0 v# p& p/ X: H" `
+ x6 n; I5 u. x9 k$ @/ X# T4 Eif clng(admingroupid)<>0 then
5 e- d- w9 Z% i C: T& V- x
: [4 S- ^5 n2 [2 P& \admin_lever_where=" and menuid in("&admin_page_lever&")"7 w# F8 Z( y3 w" L9 w7 y
. k: x% {+ K- a8 v: |$ K( Lend if
3 j' \, {7 O0 I- S) i # U; e1 e/ _ F2 }' T9 D+ |: [
end if* \, i R8 ^: p9 y' C
5 f2 v) v7 t+ I2 l3 T5 K
end if
# m1 p _: j8 t9 r2 \3 l7 g
% |! b6 s# Q4 g1 j% Wend sub
. o) v5 n0 n5 d; l7 G7 f; f1 D/ t漏洞证明：4 j2 C# s/ x: ~, n& N7 z
看看操作COOKIE的函数& J! D, l: ]* x; ~& L) m, [; z
' [3 W6 Z; X3 s: {, U
public function loadcookie(t0)
1 w/ T. k, J# f/ a" c8 I
3 Q2 e) U$ m. q" s, P/ n0 {" cloadcookie=request.cookies(prefix&t0)
1 H( M, k! }% K& z. O, R
$ w$ C& r$ O# kend function* M0 b3 J6 F0 l! j
2 X$ t( @9 C" P: Y) G% }# l# M% e& upublic sub setcookie(byval t0,byval t1)6 J( B8 C/ f7 {6 T' C
' U, r5 U; R6 \' o# aresponse.cookies(prefix&t0)=t1
; U" V/ P* `) B, H* ^5 w+ D" m ( e7 d9 [# |- c. [' B
end sub
7 l! q* Y J3 _4 X) y) M / P' w5 C' g' w4 Y6 k
prefix
1 w0 e! \! i/ \# W0 L
' z8 H9 ~% s& q; J. v'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值& U1 o/ [7 @0 N
, D/ b: j2 T3 S5 o4 l
dim prefix
4 N. a- q- V4 |" T, o2 I
. h. ?0 k S6 s8 f3 T, a' l$ Nprefix="1Jb8Ob") t' k8 m" ^3 }9 X. t5 f
+ q$ g. o( D7 }6 [/ [* I2 q* g! N'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 # b9 X. Z% r. w& t2 p6 e3 r: Y8 }
( K# H2 z- i6 a) t( ?sub out' U4 @, p& D1 \, |( l! O- R( f3 s
. J# l- P8 p5 a v* V& U* zsdcms.setsession "adminid",""
# F: p( @! ]* A; y
, t& H5 X) o$ U& rsdcms.setsession "adminname",""
3 i; q1 H) Z0 \3 l 5 T9 O# Y4 F, X, }* c, E) ^! C
sdcms.setsession "admingroupid",""
& J: V# k- l' Q, ?- l 4 x8 q$ L/ E- Q" C, H
sdcms.setcookie "adminid",""; X5 s, J2 K$ }/ |4 T
+ b& A5 a0 H- R) n
sdcms.setcookie "loginkey",""
. Y. B# x& m' C# [ V- e G 1 M9 y0 F) O" j* Z
sdcms.setcookie "islogin",""9 o7 s1 |9 y2 Q2 F. o x8 W
$ z% m: `) ]9 z. P/ A
sdcms.go "login.asp"
# i m6 R2 ~, V$ ~9 O; j9 [
5 _" p! l3 m# t) i- Qend sub
" d8 o$ a1 }4 D+ N: F
3 @4 y+ h( u+ X& |% U" y
$ O2 l6 e% c: K% d- X利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
& T' K- d$ B: g2 ]7 Y2 r3 f修复方案：, a$ f3 s) K/ y1 H
修改函数！! Q, _$ N* Z, H' @" B% _0 H8 E
|
发表于 2013-7-26 12:42:43
收藏
支持
反对