要描述：
0 B2 @7 l% A& R/ w O+ v/ `' Q
$ Z, e) I! X1 M3 A% `3 U* kSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
( a2 {+ k, C) X2 Y详细说明：. b7 @/ d! [/ B; o
Islogin //判断登录的方法9 y0 `/ Z* y0 _4 |! V* U; l7 m
( O! {( b& D! [$ \" msub islogin()
4 c! A( I7 `' G. ]1 m7 \! V ; {& V# q+ S. d* V$ T
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then : V0 X3 w% Y6 R" g1 M" G
5 g+ v l# n' O. [dim t0,t1,t2
$ n* y% g3 K7 ~/ ` ( |0 g" P D7 ^( @! m3 G3 L
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie / T/ m6 ~0 l/ x2 a. p) `
4 ~+ c' [! ^" h Ft1=sdcms.loadcookie("islogin")
9 o9 f+ j$ Z5 S7 H
8 [/ i7 \. T! z* ut2=sdcms.loadcookie("loginkey"); j- G+ a; O* r! V( U( ]1 z
0 {+ C, R1 T8 wif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行! P- u# c# D7 o2 m0 L, a& V
4 @; F' J" s& I" J; u8 n, q//' T: t6 ~0 [3 U# g$ s' S- d# j
- e3 r9 Q+ l/ \& a8 X( L' s/ M
sdcms.go "login.asp?act=out"
0 m% Q+ W% ?; m) a. |( L0 |, L* ~# M
4 K' Q' U# O# Uexit sub) F* Y7 Z5 m: N T% B5 q
+ w8 c( i+ f. C$ P2 J9 Pelse
# v. U/ ~1 S- J, ]: i& n
2 T$ `, z/ R3 Z; a' t; D7 B; t) ldim data
6 ?) C$ t; {0 H9 v0 Z
4 @, v6 L8 e" J* x6 Rdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控0 o6 ?( Z1 m* M/ j, D; A9 i
: i( w4 ~' y* h6 ~& M- g2 ?2 F
if ubound(data)<0 then7 T# r: r5 s1 r P: F) ~& }
0 E# y4 d, o o6 n3 n- s
sdcms.go "login.asp?act=out"
, r% ~' V8 t/ j. d; [
. l+ g( l" w! Y; F% j% }, G2 G& \exit sub
: W( X4 E2 p2 k- A6 Y% A# R
' O; O, ` ~: {2 \ b$ Kelse
, Q6 s0 j& c5 y4 g3 B3 h4 g# {+ K 1 ]' B. t L6 r, C$ e
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then1 }/ w! h$ z2 o, q; g
% |0 _6 m- p# Z1 N+ ]sdcms.go "login.asp?act=out": Q. C! l! s6 r7 `) \" U5 a8 l
/ f) \5 U4 h d. v
exit sub Y: }& \' G: E) z( z0 W2 t% v
4 Z1 r4 v$ m) i7 \
else8 Q# o6 C' N0 R% u9 Y
5 w3 H: N4 d. p" Padminid=data(0,0)
# L- m0 g4 L5 h. n8 } 9 l V7 G4 h6 R- ]
adminname=data(1,0)
) o6 b8 I. T n5 d / Q1 k3 B& _. @5 E; h5 q" L
admin_page_lever=data(5,0): g# Q W, H( ~6 Y% b. l
: ?: M; z, Q' [0 kadmin_cate_array=data(6,0)6 |9 D) V% r* K
6 D& G, ?) x( T( K$ u' ]# w& T
admin_cate_lever=data(7,0)
# p2 O5 y$ F6 S8 G 7 `; ^' J* r# l) V* b4 b
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=07 Q0 d: b0 Y" e
$ b2 C% C3 `" V
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=01 c; ?3 s- a! B
0 t7 v# J( ~/ ]/ l+ m+ |' J+ _: r
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
: _) c# i! O$ |/ _5 ]9 h
# U4 C1 T$ L; e& zif clng(admingroupid)<>0 then
" c% Q/ l" _9 Y r4 u2 A$ @1 }
$ y, C2 } E+ u9 K; h1 kadmin_lever_where=" and menuid in("&admin_page_lever&")"( g1 `2 t; d0 @9 [
+ \6 g. O1 J! ]# s
end if
# t* D V/ t. p) q( k7 }) f6 g# m 8 `5 Y+ j g+ r1 T" B
sdcms.setsession "adminid",adminid W9 Q% |8 l. V S' w
# ^/ P6 y1 ^ K# s( R4 Lsdcms.setsession "adminname",adminname$ p) U! Z8 h3 o4 u6 t" T
, X0 T! M" R# c1 M4 u6 E' gsdcms.setsession "admingroupid",data(4,0)9 ]0 J& ?& |7 r' \1 `* T' N M
2 b( x4 w: {2 ]$ z8 z1 s* F- @; ^
end if
) j, W5 m: [' f# X5 V ) m0 T9 C% G+ P F* m
end if! j6 R2 p0 Q0 M9 F4 E$ }" o
" h+ P6 z3 ^5 m
end if
! K- S s8 X n4 ?3 U1 G/ c& P
0 @. s0 J1 P! R. U" c% ?1 qelse
4 q' o- d x4 |6 ]% a, W
4 K, \" x+ O# l4 j, qdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
5 Z' P/ s8 G: D1 `4 T , J- d3 r: T! Y0 L) ~/ ?/ w' A! X
if ubound(data)<0 then- `* _7 F. l0 O! d# a7 a1 [, j
% B7 D, I% n, |2 Osdcms.go "login.asp?act=out"7 M' F J# ~0 k" P* o4 v
8 b( I& h/ v& z3 @1 T
exit sub
s( V8 A& B; f 3 B# }" `* A+ a5 V3 ^4 r8 l
else
' J6 { V* D5 L 2 l4 G! q7 y' A6 K: A& q2 x
admin_page_lever=data(0,0)- T/ F; z; L, I2 @# K
! ?1 k- q1 _2 e2 F
admin_cate_array=data(1,0)
- A+ V8 o3 E& F6 P$ N/ k) ` ( u7 A- x) y* V/ C7 T. s% F# F/ G8 ]
admin_cate_lever=data(2,0)& ~: g% i3 J8 F- `+ [
: [- W8 R5 r7 k' o( B5 u7 F; D5 {0 m
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
7 ~$ p/ J2 P- L4 _! T9 Z
! J) C3 m- S. T$ E: s0 rif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
# F; j8 k, {) J; P+ K; x # \; [0 ?6 y3 y( ?1 o
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
* v( m9 k! U# R9 N l
% E# h1 W" j3 S, d6 Zif clng(admingroupid)<>0 then% c' \6 Q" K+ B5 W3 ^( E2 y. b" @
+ y' P: r6 L8 N" Dadmin_lever_where=" and menuid in("&admin_page_lever&")"
1 O- y1 z$ Y2 _$ Z# B( H2 M
& _& a7 k; _& {+ h" f- Tend if
" k! F g3 h# k2 {; u5 A 3 n* a% r' d$ O) f% Z9 j
end if
4 E* K3 z; Q% D3 d5 ~
! |8 S* O3 L- |end if
9 s/ h* ?$ K0 H6 s) _7 N% O: R% H ) `: }& J4 y1 e+ B* Q
end sub
" I) {! q$ m1 a" T4 N漏洞证明：
) d* n, A y9 ?5 C1 w看看操作COOKIE的函数
6 W4 k' }7 z, B& V& w
9 e+ i1 V$ R9 a$ z9 f& ], o) H7 [# n. {public function loadcookie(t0)9 N; r, X. U+ N/ m- I& ~" D! J5 ^
3 i" E. `6 r" e. F4 [+ ^2 g+ jloadcookie=request.cookies(prefix&t0)
8 x2 `; @0 S _. L6 r$ N
5 Q' H' r& i( w3 Tend function
5 M7 l4 j# D( R% A5 E : [; z! O) X6 g" _' z( h( h
public sub setcookie(byval t0,byval t1)* O8 k2 O1 U' j/ i4 O( [3 S
' X+ X* ?/ h1 K8 g: g
response.cookies(prefix&t0)=t1% G |& {8 p1 m
7 U- X) s) p+ W V
end sub
' m: ^# D3 F% S- p 4 I" P8 F) S, M
prefix' j z Z5 }3 y& Z
' A* b2 A% u) V/ k7 x'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
4 X0 i' Y9 `# a( }
. {0 i6 z$ j1 R& A4 _dim prefix: H8 K/ P: V1 j9 t$ F) J
2 Q+ r( ^' S! T( m" O9 d, O9 t
prefix="1Jb8Ob"
, _! X7 l0 f$ V9 l7 s5 ` - u8 s! y! q1 x; f- h
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 : P {. u, X8 H0 v Q
8 D9 j4 O$ E i$ T- R9 |/ `sub out
* p3 c$ V$ Q9 ~& n# c+ }( \. {5 N # e% f& i6 w" T$ }
sdcms.setsession "adminid",""! {$ e: d/ x- p' B {# E9 Z5 C
3 n; }/ V+ P5 |" w9 d9 J
sdcms.setsession "adminname",""7 U u3 S; o# P" v" [/ q3 Q
; R# W: D5 I0 B/ p+ v
sdcms.setsession "admingroupid",""
. l3 [0 ~9 P& N6 c1 Y3 H' o ( [ `% w+ l; X; i
sdcms.setcookie "adminid",""
/ N5 A" n+ t9 x2 G/ ^: r( t % p" Q( f/ v% C7 T7 x
sdcms.setcookie "loginkey",""3 O6 z2 d- x& h6 l( b! M- r4 i
2 P: b0 p9 j% i0 N9 i1 k3 j( e# ssdcms.setcookie "islogin",""5 }1 [5 k) r3 p. V
5 g' y& F G H" t5 h, O8 i
sdcms.go "login.asp"
$ ], [: E' p. D7 Q& r, t4 W # L/ R1 b, p7 C9 |+ a* y! \* }
end sub
) h+ {( k9 j! y8 l3 D2 @9 | ; X/ P, M1 @6 u! U% m e6 W
! y0 r1 D2 S- _" ?利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！) K8 m/ p8 o# |( e/ F% X& Z
修复方案：
$ i4 t6 P8 M& q4 H修改函数！
8 ^4 Z; m5 F U: H5 A |
发表于 2013-7-26 12:42:43
收藏
支持
反对