要描述：( A" W7 V) N! }/ `- Q. n* d
- Z0 t a2 Y' p. A2 }
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试. z" _( x+ [" |
详细说明：
9 m: T1 B6 ~; F6 w$ J* x( BIslogin //判断登录的方法/ R E, C9 V: k; P
: m% _- q3 ` Z: psub islogin()$ ]* N) x0 ]& ^" \3 w4 N8 }5 h9 d
" [. @: j) c9 n( Yif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then 2 P; l5 O1 O( j) t1 `( ^/ X) v
8 f; K" t: f) s4 `. I8 C6 idim t0,t1,t2 , ` v6 i0 M! e* [+ J4 y, [
: m/ `, }4 w% i. F% N2 \0 }t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
0 K% z2 k$ O! k" w$ S 4 Q2 E; m4 q; y; q) b( `( e5 x
t1=sdcms.loadcookie("islogin")
0 l7 p. k; ~. N6 E
! K6 | C: v# [9 @1 `t2=sdcms.loadcookie("loginkey")4 u1 F2 p* I* L7 M6 Z4 v1 S
. ?) _8 T' x6 l5 i" b
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
" ^9 ^' M9 P- H0 P# V5 E - A7 a& ~2 C1 ^4 }
//3 e" O, `0 z( @( V. ^3 Q
! \* f& G4 k. ~ q; s! c: d
sdcms.go "login.asp?act=out"
. ~) v7 _+ w6 u; `. l
+ f7 Z, B- Z+ j+ c. W& @3 Sexit sub; T8 O7 D+ ]2 o+ \! M; M
# c, y2 c; n4 _6 X7 Y& ielse6 w2 @2 q7 ]" z/ {9 g/ A9 q
+ t0 g8 u3 }" L. o0 z4 y
dim data1 B" f8 ~1 ~4 c/ j' h! ]& ~3 l
$ e4 F7 o: T t/ u1 W" }data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
e. t3 m. d* m) q
" U% ^* G2 e+ b& Q5 S' fif ubound(data)<0 then
5 E. _3 ~' {; g6 e- m! b
, O4 g! Q$ w8 L% C6 t) qsdcms.go "login.asp?act=out"
1 H( J% ]% ~0 y2 u' `2 k2 H4 \* T
& P, V) G! R+ U, e/ _exit sub) E) ~( ~" K* M+ L- R
d7 J. h( r4 |+ b8 |, x9 selse& `0 m I+ v# l4 G0 a
. L) c" u: p L; v' @: \
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
9 b9 Y% d9 \! u) R+ f7 a
+ z+ D8 ]. I* d' ~5 P5 Z; Zsdcms.go "login.asp?act=out" a* X, `! s% A( X3 ~
5 W5 e- V3 ~; b% J9 _exit sub
/ B& `/ A) `. M/ t f% C* V
! L% K# D" }3 @5 y8 `- M" B, A% belse
' n6 q- @. g- q5 R
' q# l/ Y+ U8 h. d! Radminid=data(0,0)- p1 Q) `5 M; X/ j; c
: p7 O* S2 U8 P9 ^. I" a* e' s3 \# W- U
adminname=data(1,0)1 T2 n2 ?7 [9 h% A' u! T5 r
2 {$ y3 C; e. B' ], ?7 Aadmin_page_lever=data(5,0)9 B4 R! {+ ], w# v( @2 y& ?
3 F: Q( B3 W2 j; m% u9 q
admin_cate_array=data(6,0): I6 u% T: e$ m- a* A
. C$ \$ [! ]2 r7 R
admin_cate_lever=data(7,0)
# e# ^) p( G4 h5 `: a! |) a
% i W$ V- m+ q2 ^! @8 tif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=03 h* \7 L0 I( L, n$ Q
! U% f4 L' z4 vif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
U4 ~- |: v1 o 3 Z0 U& [) ]( `& F2 r
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=02 V$ a+ p9 i( |2 _1 B" L3 Q
) m/ G! w4 C1 Y) j' e( ]if clng(admingroupid)<>0 then
. H( v( m7 ^0 r. G V * y! O. H4 a( p' Q( m
admin_lever_where=" and menuid in("&admin_page_lever&")". x! X) C) @7 D; J: L+ Q
X( s, e! _* d/ y8 h4 E& i4 W6 Aend if
* \/ \/ @" K2 ]) H. `
! Z# g0 k9 a, P6 h% X. ]sdcms.setsession "adminid",adminid$ k* T7 y6 Z# G1 f, P% s" ]! I( l1 g
. F: u2 R3 B! O5 p9 b) @& Fsdcms.setsession "adminname",adminname
/ M/ \" e- Z0 _- ~% S5 }: g * }4 \* F4 L, a) _+ F5 C- z9 @+ Q
sdcms.setsession "admingroupid",data(4,0)
9 z7 z/ v& B9 n5 y - H/ S, m3 Z- ^! }: x; m+ [- v& X
end if7 `+ X$ P7 {. ^" j: d
5 h7 ~, Q! }8 I* _8 Fend if9 Z3 g) b! y; U& c6 F! }5 \4 ]
( \ ]0 g9 @- R, r( `, ^) p: I
end if; L( c, e& y4 s* R7 ?
* X& L4 X2 N, A1 w; I+ u7 I
else
9 X4 n# Q1 A/ ]' d " }0 B$ B" w$ e* i; `
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")1 [" p k" G5 d5 E! S& w0 m5 R
1 |# b3 \* h$ c- X
if ubound(data)<0 then5 C; u' j+ @1 Q- n* M
$ I# d. c/ F0 f$ F
sdcms.go "login.asp?act=out"5 D8 ^0 [6 z& o
# E6 k0 l7 q5 W' F" o u
exit sub% R% Y7 p3 i- }' Y2 o
; a& p L: |: q1 x
else, {4 u: T) l! w/ F8 J, F( ?& E7 z
" k0 ~# n- M$ u @
admin_page_lever=data(0,0)7 e/ j% d. f: o( B
0 d" v: Z" K6 J
admin_cate_array=data(1,0)
+ R' p: P4 r$ \% J3 V8 w9 W
1 G* j1 U( c ]1 u* [admin_cate_lever=data(2,0)
# `( z: ?% ?( [: r* s
& _7 I. v* w( j! z6 H8 U! vif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
* u) P2 g' S( j
, x. E8 a% y: @/ g2 uif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
; O8 o& U$ u, W! U6 e
6 K2 w4 Q$ [* gif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0. E5 ?' C- H8 W* b* h ~
1 e% t# d" _! p, P3 n; |2 oif clng(admingroupid)<>0 then& M# Y( C p8 |3 N1 I4 `3 l
# O! ?* K8 y1 Qadmin_lever_where=" and menuid in("&admin_page_lever&")"$ |; P% _3 ~) m+ ^8 E9 `
% ^+ n4 z0 j* nend if
7 H j" C; x) \. g2 Q* u# I% x 1 Q3 w9 T$ |( E/ i
end if
0 J' X+ G4 g. ~$ c: `- t
* n* u% ~$ x! z; ?! yend if+ i8 Q* `6 m8 c' Y$ U' B" G9 K' a$ V
& M. ]9 p$ w! t. c3 c, uend sub
$ I' c O0 E$ p3 q+ U- R. A) v. K漏洞证明：. s5 K2 {0 u$ U$ h, }, X
看看操作COOKIE的函数
$ A' H& s+ G7 I! g$ h
/ x3 a0 M- U& b# s2 C* Apublic function loadcookie(t0)
8 F' V- V/ n9 m; q, {7 b
) a8 F* d% D% H+ H7 O( b3 b/ gloadcookie=request.cookies(prefix&t0)4 }8 t, |. m2 O& T5 F
" Q. ]8 h% H8 J9 z! pend function
" d0 v. t2 |5 z+ b( l; Q
7 V8 _1 X- O2 J" rpublic sub setcookie(byval t0,byval t1)
e+ i, W0 d! S2 ~. y- @ $ [6 }& k# l7 D& N: t# h9 R( C0 ?1 X
response.cookies(prefix&t0)=t1
0 z. y2 x! ?: I& ^: g 9 ?/ K: \& X( Q$ K0 l
end sub& i$ j0 y2 k+ R: E% r
& y5 R) P- I) e! g( E8 G. x- h6 N
prefix
" B8 q- u6 _2 g5 i* M
0 o) m' B/ Z( |7 M* O'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值- u5 c+ g! t2 t Z& l- b. n5 Z% R
. ^. g- j& ]. }/ `# p& Y9 i2 H
dim prefix
3 e, J2 I/ S4 j% Y* N* h
8 t8 U m, E! |* ^/ ~/ q" vprefix="1Jb8Ob"
, _$ B7 d i% x! y& S: M - a' T* g$ _0 f+ l7 k* Y6 \" [
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 - b; x9 j& f( ^" G! t1 {
0 ]5 [) G8 b2 ^% \. Ksub out
; M! o9 S$ }: s( L5 f9 r " T% o" D! C7 z* i$ @
sdcms.setsession "adminid","", S; W+ l. n" l* ~2 r
4 J, k" L4 k/ i- n: L3 }' H
sdcms.setsession "adminname",""3 l5 S9 h& U* m1 Q: L9 b4 c
4 p/ M9 t/ X9 x% e8 |
sdcms.setsession "admingroupid",""
4 j- f6 z) J1 R0 W' c: k 8 d' z4 w/ A7 Z+ X
sdcms.setcookie "adminid","". s% t: `, P0 @
. J% F" R9 H- {; x/ V& E# @) T
sdcms.setcookie "loginkey",""
4 P% { L, w2 j) H% P' `1 ` ) U- |4 T, W* B
sdcms.setcookie "islogin",""
# W7 h) t! P: |, W1 x' t 3 O4 k$ |8 \0 o
sdcms.go "login.asp"
6 ~. ~8 `1 @ J: ]. J; @' X 7 ]/ u: G* F1 v/ _- P* a4 h
end sub
9 e& e0 U( c8 D. M5 Z
! r( X" C: s5 [0 i; Q0 V - ^& A. r- M+ z& z7 g% n" k
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
/ D" X; v$ X4 Z0 G修复方案：% g% L- u0 F/ V* S U! U
修改函数！
9 }' ]; Q) E8 a- E' V8 }2 a |
发表于 2013-7-26 12:42:43
收藏
支持
反对