要描述：3 @3 g% S' k. V4 T# s4 H
: X9 U }4 w$ |4 w/ B6 S5 ZSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
( O- _+ g- p8 m! ^7 \详细说明：
& l1 j( r. z% }7 q; K3 {Islogin //判断登录的方法- Y6 H# ^. x6 J7 U$ [0 M1 R1 p
2 h; c7 \; ~+ |* e
sub islogin(), D# {& J* W! L
, s( N4 j, f- L$ E7 [8 Mif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then % ~# H2 d* ^; |5 j4 m0 u
0 m* X2 O, O5 q! M1 _; Q
dim t0,t1,t2
( L( z7 X; }6 s0 e8 n 8 C& A# Y9 Q& i7 P
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
+ E7 |+ H4 B& O $ {" K6 Z( x& S; |5 H; ]! Y
t1=sdcms.loadcookie("islogin")
: E( n8 L* N7 r2 x
4 U0 x" A4 c+ l* ? n; [9 V# Tt2=sdcms.loadcookie("loginkey")) A4 ?3 o9 D7 j) c0 S# [
& @, d% c) }0 x; {
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
) G8 L3 {" d T' c5 _, w5 J
g' I3 K) S j; Z6 |8 d |//
. b9 Q. h# B* _) k7 k5 ?
# l$ {) v$ [( |5 x/ T/ xsdcms.go "login.asp?act=out"1 I2 ]; e9 t5 ^, i2 C f
B* i+ V* G4 t8 R. j: @
exit sub. E1 u, r q& r9 b, Q* Q5 ]
( i, s; c6 F* A9 ^else1 h% k. T/ _5 C i
7 o; U4 y4 ^% ?
dim data$ V% v0 v: F; P/ A
! F1 b# r5 P2 v( F' ?4 T! z2 {data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
( M, W6 G* a- r+ K9 o
* a; e4 Q; X: {- lif ubound(data)<0 then
1 A+ ~# h: p& x, u% V $ _0 K7 o6 x3 {' V* S9 U; l
sdcms.go "login.asp?act=out"2 S! m/ f2 w, J, Q7 n9 U
4 ~2 M- E9 H7 u) S% y) _exit sub
9 _3 T. s" Y6 R# J 6 Y6 h- S" \* f) @; Z5 k% q2 K- @ I
else, H% y4 |. e" k
% `5 n6 N0 q* o/ z. k0 j lif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then3 ]2 o6 T# k. T. p
3 f8 I& |) O' p4 r$ u; {
sdcms.go "login.asp?act=out"
C4 H+ h) l0 _7 V' F
$ h1 H2 Q% W; ]9 o) p. vexit sub3 p5 e$ o( Z& a6 R* {, R5 V( t
& ]6 D( w; H$ }" q% b: Q& J
else
7 F' O8 Q4 ]% G& P5 w, o$ Q ' F7 K0 x2 R! k: e9 e6 L3 W. U
adminid=data(0,0)
* ?* {" p! k q+ E9 T ; C2 f/ [ C3 G8 G$ E% Q% c2 u
adminname=data(1,0)
& t3 T1 N2 i/ ?$ V, S4 g- x
% B& i+ E& T5 }% W5 E- a+ n; `. C% q% g8 Hadmin_page_lever=data(5,0)( U9 H2 h! Z; C6 c3 J
; W5 {: i& ?2 w9 a8 B6 Radmin_cate_array=data(6,0)( a( p, O7 ]" ?7 `% n; [
6 v# \, Q5 G# X g! h& K* padmin_cate_lever=data(7,0)
: \! k: _; A; Z& F/ Y 8 r3 U3 Z+ }" t. Q% @& e8 Q( n' Y
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0" Q$ t& E+ `7 @. s1 k9 K
( A. a3 t, N* e$ _) z' U z1 X1 D9 _
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
, v- R# D9 j8 V: b
* ?, x# c4 Z2 b- \7 V" jif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
2 C/ l" P L% p+ Z1 _
5 b% `* A- F) _0 lif clng(admingroupid)<>0 then
9 S8 I& X1 P3 \" Q( Q $ m) h0 l3 ^) U
admin_lever_where=" and menuid in("&admin_page_lever&")"7 K5 i: s: B+ Q
: B# ] b& O- {; x9 q# i9 Z
end if
& A- p7 c. _4 N5 i- P2 @8 }& w0 [6 c 7 J+ V% f" m* c0 [ d
sdcms.setsession "adminid",adminid
4 ^# h& Q8 N+ |: n- H
/ j! A) g; N4 D4 G3 O0 F2 Tsdcms.setsession "adminname",adminname
7 V8 l0 I$ A+ }, e: y) p
% [3 z6 g. z, N8 H w/ [0 r }6 Lsdcms.setsession "admingroupid",data(4,0). B, X+ i1 O8 Q& \0 X- r
4 ]4 D1 M5 Y+ |; _% O3 Z1 y c, d
end if% I: a$ w, J/ [
& @6 o. x t6 l3 |8 }4 V$ P
end if( L& Q5 Q0 k1 @0 C4 \
8 y5 r3 K l4 I
end if
* s! F$ d9 h: W3 O
4 H" ^) `5 Y) g c" e, c1 ~else
) f! n0 P4 D/ P# M. o7 E! d! f$ V
1 W, q R3 J& A F E* Q: M! Gdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")% y( G1 a9 O! y2 i- l
4 ^: M% Y8 ^/ h4 H& i( @
if ubound(data)<0 then
0 K# G8 ]! r! i- j# s9 ] ' Z* f6 }3 Z. u
sdcms.go "login.asp?act=out", l" k* D k6 g& \7 `, `# W. ~2 D& j: g& R
1 r# l! G( y+ Uexit sub
# w3 h+ z! U9 f
1 J6 K3 h1 A" p4 D; ?, Kelse$ o, X, U, t0 k
& X# A7 S' _- K, z4 \
admin_page_lever=data(0,0)2 o0 H L* N. ]$ y
! Q: i& u6 h! K5 h0 Madmin_cate_array=data(1,0)
! \( m& h6 L+ Y3 [ . B7 _$ q# e Q$ L6 W! Q
admin_cate_lever=data(2,0)9 }8 @' J) Y% d, M6 V
3 a% m$ m& O0 V G1 s/ Hif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 ?8 f, d! o1 V8 O4 d
& |/ b5 X7 C9 j# lif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
, E% C/ v) b. ^7 x
2 N/ G. E8 X5 zif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0( k9 v# d7 {/ E: I
( {4 X# m2 G( r3 V; ^7 O: t
if clng(admingroupid)<>0 then, y' a. U8 N4 W
! n5 B! `2 g1 q, ~) a' ^
admin_lever_where=" and menuid in("&admin_page_lever&")"* X- u7 t% O- b" [9 G
/ s4 J$ ~1 ?0 I# l% J7 S' [" H! e. o( `
end if
0 q% @# P5 ?4 a8 B! w# X7 W ! y) l9 o* p* L% `/ T$ q' G0 J( ?
end if
* d5 D- y7 m p! |- T - ^: j: b7 F( a2 n4 h- m+ E* n: p( t
end if
, D# d: I4 T3 ?* a( ^5 t; b) w
" ^' l& I2 F6 g, \) l; a( D! yend sub
. ~9 a9 f9 z) |3 X漏洞证明：
% U4 U1 N8 P0 d看看操作COOKIE的函数
1 b. B; M& o( Y/ l# D4 K% f) J3 w
' d+ F; F' H$ w3 p8 `public function loadcookie(t0)
, M+ l( v5 B5 H# B; g
% |" P' h5 g) ?! R( }% h: T6 Tloadcookie=request.cookies(prefix&t0)
4 ]% w3 d. ~! [! o7 }
) l2 V$ J+ s# A7 D4 v+ j" Nend function
0 k& _4 R- C# F: B# @
! c g1 u, Q2 U3 ], m4 Bpublic sub setcookie(byval t0,byval t1)
5 N. g U: z2 a/ _5 O& `
# P) @* O4 i4 ^- }+ Dresponse.cookies(prefix&t0)=t1
* S9 N4 I# z- j4 C " z. L9 ]# x+ \8 [6 V, H
end sub
/ |# B/ Q+ L! O3 C! q) d. [
' ` _1 h0 r, w5 N2 \prefix
# }/ A. G1 |+ z! w+ _2 d
" M# }* Q2 g' `$ i2 B! P/ D' P+ l'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
& T( a- T. M8 Y
, b% f" r- d. J- \! k9 r# cdim prefix- \3 I# ]7 j2 r$ w* H+ {; A( ^
4 v3 e2 x' q" F3 q' g4 p7 p; X
prefix="1Jb8Ob"' H! e/ c; n/ m- v
8 J5 r) y$ v" t6 ?, e* f$ v
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 ' ` x8 m" ~% g) K% H$ u
! h' _, F% B( y8 q3 { v4 tsub out
- b5 [, I5 A/ @& ?4 d' A, }
) F9 M. _1 W9 b" Gsdcms.setsession "adminid",""* Q( U8 P; k- T" S1 A
- p+ {, d W/ ]& Z
sdcms.setsession "adminname",""+ [. b- i4 Y2 `$ e2 u
3 j0 q& r+ `& _5 i4 Xsdcms.setsession "admingroupid",""$ |0 c4 T- u/ }7 g/ b) R
- Q/ _6 K' ]( d) O; F2 ]/ P% n9 Wsdcms.setcookie "adminid",""
% A/ h# M$ y: G! T6 z1 H6 H1 U1 D 6 u3 P1 \& @9 `8 v
sdcms.setcookie "loginkey","") U+ ^( n" a' Q$ k
- i7 r! b6 z- y5 wsdcms.setcookie "islogin",""
$ c+ i( p; C3 {) F
2 U9 N8 B4 _% |& lsdcms.go "login.asp"
- q- }/ S v4 K. _$ s3 [
7 U2 L2 N" p, W( }* B( g/ gend sub' h) _: m+ a2 L0 J, L* x( D$ X/ ]
7 y5 V: Y o( y$ k R( Z2 y# Q
1 v, ?* @% t; V. t8 Q, g利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！4 k) w7 [+ F6 X
修复方案：$ r- Q. N3 b$ }2 q
修改函数！7 `! F$ a1 f" D ~. _, f, D- Z
|
发表于 2013-7-26 12:42:43
收藏
支持
反对