要描述：6 r% Z& X4 _. t3 S" y8 x
% V! I% o0 D+ x3 y
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
D% ^+ L/ p- ^; S @6 q( ^6 K详细说明：
# S. U6 d1 F* F4 a! ~1 v+ J( @# bIslogin //判断登录的方法2 m3 O2 H6 Q9 j% k
1 m( v3 p! m6 P3 d. Psub islogin()
% l+ S3 i; `2 \% y9 k
8 ]% W# E, z, ~ K8 bif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then # Y) s2 B9 R% x: V5 i* D! S
. N) A* ?) T4 j) `3 C0 |* f
dim t0,t1,t2 5 i& B( B& D9 L
+ E9 g; C9 n% ?. O% Z8 et0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
2 _4 W4 t: i9 p9 T( Q6 r7 j, J
( C4 @& O) c; w# L, l- Bt1=sdcms.loadcookie("islogin")
8 W" n2 d9 }7 G / C z- ]0 X) q9 `
t2=sdcms.loadcookie("loginkey")
8 E+ D% R3 Y# B ]3 R
# y( e. ^, c r5 L" i6 G% nif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
' |0 b* q) i3 m8 ? m9 D # I, I' z2 `1 Q( Q( g
//% L# i% G L! I5 H
' C1 Z2 n, Q# s) K9 l7 v' g/ n
sdcms.go "login.asp?act=out": \8 y+ f- v5 M6 G" q* b: D
$ ?. }( u. E: T `4 nexit sub. A1 Z1 M q0 U! D6 R6 X4 B
; K' \1 R5 N1 M+ W- Z9 `1 `: Y; helse3 s, z% v3 ?! D) p
' z( F7 `6 d+ t- y& W
dim data n" ? Q" H" B: `5 u( B
$ W/ t! V% v; }) S6 i" W7 G9 }
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控2 ?# C: O9 ^3 O* M
, S3 s2 P$ d& W ]4 l N2 T- O
if ubound(data)<0 then
" n- S. a& C9 ^; R9 }; H6 a( C ( Z+ Y @/ h2 d3 J' E/ u
sdcms.go "login.asp?act=out"2 `! @% Z% |- X2 v* p: O
0 G; R5 a" R: y2 _9 @
exit sub- G& H7 i7 h5 c( b8 Z
! Y/ Z4 A( g- r
else( m0 M5 y; y; Q$ C5 o2 q
9 s: I, M) k7 c# P
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then/ u- F: Z3 g/ p0 f- D, l2 |# O
7 c4 J e7 T( y- N4 |# Ssdcms.go "login.asp?act=out"$ G ^4 q9 g" m1 k0 ?9 Z# Y
* r( D ?8 |! C3 ^, ^/ @4 l
exit sub4 \6 t# @0 J* C* Q' D
% v. A8 I6 S/ E& L3 y9 q" ~
else
4 z( f, J7 K: u5 o- t* Q
) T( P* n( A% j9 r/ Uadminid=data(0,0); c1 e* z/ V* w8 L) f" j
, U9 v- s1 j# ?+ E7 h
adminname=data(1,0)
1 [$ w3 I8 r# O- q" |8 h' ^3 P0 R
# ]: {9 B9 I) o, Jadmin_page_lever=data(5,0)0 [6 h8 x0 i* g) `+ ?% Q i" A
4 W. h* J& J& `" l& |" O2 zadmin_cate_array=data(6,0)
3 P& W6 | Y5 g" b* } , S+ |0 d5 V4 m' R$ D2 P
admin_cate_lever=data(7,0)7 s4 n8 D6 N8 {5 v8 v5 q3 L# ^0 A1 F
" D) U, ~ S6 E! S$ ?; E
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0, b/ ]2 V) X: }
& Y h6 N4 P& B- Sif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
: g5 e, e0 V8 I* `: i Z1 ]5 a 8 r5 f) `( \4 D8 q1 L
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ I& c( V* x- O" S0 |2 i% k
9 j6 q1 D7 m" x/ I. ?/ dif clng(admingroupid)<>0 then7 S; [8 `3 c" y5 Q1 n! j9 c
k& v* n' P1 C0 z f; R; x% L o$ q5 Gadmin_lever_where=" and menuid in("&admin_page_lever&")"! w) c9 W& v- e9 T! Z7 Q, f3 o( b
1 [9 C* L! p) k0 z4 F- p+ |, o% _1 Yend if+ M `* e5 A9 P
* G9 j8 }2 c+ d) W( `6 B1 l, }sdcms.setsession "adminid",adminid4 w% @4 W {* Z
" D" f2 P! f( f/ ~: g: Nsdcms.setsession "adminname",adminname
. h$ O) d- w* `9 H! q2 [
9 D! N' m' I7 T( N- Msdcms.setsession "admingroupid",data(4,0)+ Z' R% n \) @( @( h$ Y5 J
" f3 T) G7 K/ _& l& zend if) Y6 T* V7 X- Y: l P8 n$ d9 X& V
% y' r2 I) c7 J/ K+ [
end if1 B9 g1 [2 r$ a" x/ L
1 N& @% y4 z7 `; a: t5 Qend if$ ~7 v1 [9 _3 S
- z$ S+ y# Y |- X- felse; C& j. `7 s0 Q+ P7 o
h" n) X& p1 w4 ?/ P
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
5 w _6 X* ]6 ~2 f8 P$ Q3 ^8 g # ` G! X9 Z. U0 r+ c4 b4 m7 T
if ubound(data)<0 then
: A* b( H6 c- G. e& \- @ ! ]7 @& j% O t' U; `
sdcms.go "login.asp?act=out"
! q) ]3 I4 O' ~% l$ y p. f. J7 ^8 l! z2 x& g
exit sub
; [' g0 l! ~% n$ e( _2 Z - @1 `/ H& i1 U8 a5 p
else
4 O8 _# T8 |# z# e v' z: ~0 ` . r; ^. {) ^$ L* [
admin_page_lever=data(0,0)
; a% L9 b7 M5 P7 H* X# b ( o0 ]0 U6 o: D% m3 Q- ~1 }
admin_cate_array=data(1,0): l6 `+ S9 _: Z2 O+ _5 [ J( s
+ r! o. C, ]& o# p" r
admin_cate_lever=data(2,0)' Z0 J) W I/ L& `1 D d: I
' R! r: V! l. l+ j2 G6 d+ N6 R
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
/ t+ H/ j, ]2 q `0 ~9 s. q! w( g ! T/ y9 {+ `$ F' p6 F( O
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
1 V3 F7 R- A# e. ~ - q1 `! ~# s+ x/ B& V
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# S0 l6 v6 T; C' ^) g. p6 s
+ Q! |+ K1 k$ \7 W* X9 ~if clng(admingroupid)<>0 then
% h. ^* a+ ]# Y {5 z5 e 6 P! z% x# I; ~' |
admin_lever_where=" and menuid in("&admin_page_lever&")"& x4 d0 B# N- \" Q) H/ O; P# w
( B. w9 e5 j& P, M! }/ [1 p
end if5 a2 y: K: s6 C5 [
K& P" s% I' }- uend if: j2 J' N' M8 ~- {+ Q: f/ Q* [ J
, i8 ^6 C3 L6 t* v2 V" y P; zend if
9 V' c& ]& H; [1 c L% `1 g& k
) K# ?7 g* q3 Z" s- qend sub
. C* I2 j) a3 w" ?漏洞证明：; `) f# [# M* k, }: x
看看操作COOKIE的函数9 y9 K3 H8 E6 i: f' g0 g3 W4 ^! }
, Y' u S2 ^9 ?( b! j* T) k8 mpublic function loadcookie(t0)
9 }3 u$ o: e' C% B 5 s/ x. A5 v8 P7 h) [
loadcookie=request.cookies(prefix&t0)/ l" I1 t- r3 X6 ^5 U; o) N
# Q) ^/ H% [5 ~$ h' D
end function0 M2 m+ ]. `9 e! u# d" q
5 O2 P `9 j( {6 H
public sub setcookie(byval t0,byval t1)( w+ R" x, Z1 e
M' q& U; \9 |3 g( z
response.cookies(prefix&t0)=t1
! I- ~- B. u2 f, ?3 u6 |. I3 p " q' R+ Z2 a( q
end sub
7 O1 m2 C/ }- C* S$ P7 Y" F . I+ s0 F* D# u
prefix
+ _- [* `: k j8 {: w: d 4 R; _: F; e9 f* f+ c: R
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值' _; a! U$ d" n2 b: l# l6 k3 W3 y" u
o. ?6 r: T9 i# G* j% k- ^+ t
dim prefix; i3 u, z" b9 z# q/ [3 p
$ I$ S2 p' b/ }$ B. l; V( zprefix="1Jb8Ob"
! j/ x! d9 K; b$ c/ c
7 }% X& w) n; i0 G. C, M'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
9 w+ B4 r9 T; w9 ] $ |4 ^& e, E2 M
sub out
( V' ?9 ^' K% ^* D) P& Y h; {& b
1 q/ n+ ~+ }2 I' [7 ?sdcms.setsession "adminid",""4 A9 e" t$ E9 F1 H
) H- N) p. g: `7 Tsdcms.setsession "adminname",""
6 X/ V) Z0 z* A4 [0 x7 U
6 P: t7 s; D$ Osdcms.setsession "admingroupid",""9 G, [1 @1 J" l; o. F C
0 C$ K' V5 c, q; D) rsdcms.setcookie "adminid",""
* C' t- }1 {4 {1 S5 S/ `0 }
6 m( w5 T. Z# `3 G6 o- Y8 d1 }sdcms.setcookie "loginkey",""
& M) ~. B- u: n, i 0 Q2 a- F: y4 _; ]
sdcms.setcookie "islogin",""
( r+ l8 e- p* N, ^+ b. z0 G: T- s / W0 S( j/ o- z+ g
sdcms.go "login.asp"
% ]# t5 S& C# J. y: M; e V1 ~
1 m, H. ^* L! J' cend sub
0 _0 i: F6 M0 L & A5 W& f; t! c, O
# R4 J- {/ t G4 r8 T利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
1 g( a0 p6 x7 E; [9 I修复方案：: U) M% e7 F7 s: ]* I: {# D6 W
修改函数！
2 F* O6 L6 \( n/ A" C |
发表于 2013-7-26 12:42:43
收藏
支持
反对