要描述：( W" T9 a8 h3 V- [5 h. R
! ~( b* w! p: c# o, z+ d
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
) T- ], m- [9 A, T详细说明：8 j( D) I ~6 `3 u$ A/ j
Islogin //判断登录的方法
8 }' X& {) V) u; F: a; A
: j, A$ k1 ~- K3 u5 n0 C$ } Ssub islogin()
% Q4 V+ q0 g. p0 F8 n# Z8 a
) h7 D& w7 d5 G4 A# {: k; Lif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then 9 u+ ~6 a/ M- f2 V
, J4 ? I) I* H2 \3 z+ _% ddim t0,t1,t2
! D6 {$ m: `, {& y4 O/ S0 j' \* Z
* Z K+ ?( d$ Q/ ~t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie * }' f/ q# i) L2 T3 { f! `- k3 C
& o8 m, P7 F# {4 I
t1=sdcms.loadcookie("islogin")" g4 o2 V* p' N4 l
% c0 u% F+ n0 M5 U2 P4 H5 @
t2=sdcms.loadcookie("loginkey")
' k' H) r3 m& L( J; V Y+ c
7 v% L7 }$ k' p( x7 o5 d% F* ]if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行) N ]1 L/ Y2 b1 d
+ _8 N3 ]1 E( J) B1 K ~//
0 f' ~* \# U4 Z- q5 M
( D1 [: F, Q) K' V7 _sdcms.go "login.asp?act=out"
' R2 O# y% E! s0 D
2 ^6 f; x! \0 m1 k/ R' ]2 texit sub
! ]: B; u4 n2 N# M7 |
- a8 }6 Z! s: N, q7 Melse S* [0 r. ]: s* Z% |$ \" u
2 J- A* c1 g( f0 A' r
dim data
5 M0 q# j. O" i5 u
* q: d- i q" }" ]data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
6 H5 V) Z* I" P' l1 B5 P
. ?5 C& }+ @# D' b8 Z, O5 R+ oif ubound(data)<0 then
4 I5 J, _0 E4 d n - E+ ]3 o$ m1 m1 @8 B7 H
sdcms.go "login.asp?act=out") \/ a7 I* D8 [' m3 G
6 ]! l$ }0 t/ R3 f
exit sub9 p0 N3 T# l5 @' M5 H+ _7 _; E
" r& W: N3 q: {3 i' L5 f- Telse
5 S4 S& K$ h; e3 T$ Y/ o) I 6 y. d6 `2 z" b( [, M+ m
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then4 V$ T1 ?0 I: A# h7 U
; M7 z' D' O. |! H6 I2 J* Z' lsdcms.go "login.asp?act=out"
& v0 f( q* R5 ~" Z6 a4 q ) N0 F) o& O4 @9 t f+ p* W) n% h5 ^
exit sub, a1 E# Q- x; X/ Q
1 |1 Y+ I7 d2 P- Lelse
& k4 y. _/ V/ H4 |7 v& l 2 g W9 F8 J( q5 f
adminid=data(0,0)
$ I& m7 V' u; s: Q 6 j0 O/ r: F, z2 Y4 G8 q: R ]
adminname=data(1,0)
# X' {. x0 e& C4 }
5 l* j p& E- z7 P7 b2 _admin_page_lever=data(5,0)2 L0 I( j2 h" d2 s9 G7 D
/ k2 H7 T) X# Q, a; l8 d1 l6 ~
admin_cate_array=data(6,0); q0 Z0 T) q) N$ z" Q
2 I8 O- t6 t7 X5 x0 padmin_cate_lever=data(7,0)
; G$ @% o% C7 {( Q0 h( h* W, L 2 u3 m( r; b6 t
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 r; x% g- x5 x$ ^, \
) R: H& ?/ S1 y9 aif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0% H; u1 _% q& t
* R; k& b0 |8 Z: E% H
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0+ i. E9 J( {8 H, G8 _1 ?4 p' e
1 r' L8 ]9 t) m' t& Pif clng(admingroupid)<>0 then
4 h Y; E- g0 F& T
0 i5 L/ R3 f3 `6 d3 V3 ~5 ?# Wadmin_lever_where=" and menuid in("&admin_page_lever&")"
$ }2 ~) ?) t& M/ G
0 X0 e1 r# b0 T a3 g/ ?end if8 j4 B, w0 y5 y: N* f
5 Q' n$ w! ` a% G2 H& `) ` x
sdcms.setsession "adminid",adminid
( q- n2 l1 u8 ~9 i# t
* S$ G, J% i; j0 Qsdcms.setsession "adminname",adminname) R" X! f8 j6 d7 R% H1 D, N2 g: W3 x
h: y: _' Q0 u' T- ^; A
sdcms.setsession "admingroupid",data(4,0)
: V. N# b6 R% [' a2 K$ L! t$ O
: _6 L( Z/ h6 T6 ?5 \% Kend if
# ~( g v0 s. L) t# I' ^$ ^4 S 6 p4 M! w0 l* \1 i) P% r
end if1 o% b. F0 t9 s
7 R1 N* `; L6 S' N: {# Iend if7 a* S9 `, \6 h: c; y
6 m( U6 o9 J* [$ telse# J: ] n9 Z7 D# K
/ _8 T; L- m8 o* i
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")2 ^7 n _ i. Z1 e4 B
% x, Q( t& \* r4 lif ubound(data)<0 then6 W' p. {5 |1 J2 V& S7 |
; m" _; H$ r0 E, q) S1 X' isdcms.go "login.asp?act=out"+ h4 D K( B- q# ^5 l2 I
( g5 v' z4 ?1 x: f4 k9 ?# Vexit sub
( y4 v8 o+ D4 u9 C1 {3 g
; Q3 y: D5 h! V3 o. N; Relse8 L2 c, ?2 p, }) ]2 O
5 l" `' K) d8 @& z1 { n+ gadmin_page_lever=data(0,0)9 {3 ]" G( w$ \
5 t5 |: d' e5 W( }& vadmin_cate_array=data(1,0)
1 _1 m9 y; s; p1 }
6 ?* Q! W! A. y9 t4 _" Padmin_cate_lever=data(2,0)+ W$ e7 |6 b" H7 F1 r) r$ V
/ ?( l7 X, b/ b1 V2 S& r5 A! h- xif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
4 d, D6 |- t+ S8 `! R( g. V 7 v" B0 h- s! E& |+ D
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0# Q- g- v" N+ x7 U/ Q; @5 c
7 `5 h3 S) p2 g- f- d1 R
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ l/ V- `3 x+ j6 d8 K% [5 S
- n7 O$ f) |+ O% n$ }' S6 Aif clng(admingroupid)<>0 then
, n2 s3 |- a; a
( I0 g$ v7 l' t9 ~2 O- K) V" padmin_lever_where=" and menuid in("&admin_page_lever&")"' W4 ~$ U9 p8 K0 d
* ]: g- h- p( O" I
end if
$ n/ B6 L/ u4 _" `+ }+ R3 g) C
& |; B& G Q% h. W+ Rend if+ K# N' b# s; w
0 q, R8 \2 N- T- r. B: C; S$ b5 p
end if
9 o) |& S' G1 w+ W& H
; d5 q8 q4 w& g' L, V" t& C+ rend sub
+ b% l! i4 T# r/ b5 l漏洞证明：
; O9 i2 q; r& S2 ~& }看看操作COOKIE的函数& b2 ~9 Z/ C& T& Q! S. W
6 V! ~) `3 z; R
public function loadcookie(t0): |2 M( K I- N" s* M5 Z* f7 X. |4 V
4 C2 h6 c7 A5 r5 b6 {/ [. Tloadcookie=request.cookies(prefix&t0)
F! W: T1 E" R% @3 f
# v! s* h) p0 ^end function# |5 n0 \% f3 \: P, \) h; T; G' Q
[& k' S+ [8 [& _: hpublic sub setcookie(byval t0,byval t1)5 r. J# a; `5 M0 {' ^
% J' W6 w* S2 d( F- e* H, d/ mresponse.cookies(prefix&t0)=t12 v/ b* W! @. ?$ ?8 x T
' C0 e6 E9 C* Zend sub
6 v+ k1 Q9 t& F% u- m/ j" I: } # M6 b/ I/ |% v. q: j
prefix
/ [. o3 X6 [" G( t/ |
. ^; S+ c9 L; w, {' `5 C'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
; [" H5 c9 X8 ~. U 4 @5 w+ {: D" e. Z' o7 N2 k' P
dim prefix
& }; Y1 F+ n: @) A j9 w5 i
8 m e/ d' G8 Q) [prefix="1Jb8Ob"
) f1 d7 U* d J) M& b( H3 A " F- D) D* O" T; j& X9 L
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里 * s. S& [. T3 e0 p
! z3 m+ I7 f, `2 T( U* `" b+ F
sub out8 W8 t8 p- ]3 z9 j1 r, O# F
4 u+ M/ n- U5 a# q1 O+ O; Gsdcms.setsession "adminid",""
# I, h. i! {; w, T8 f7 L* `8 S2 ?: a
* [2 x* I' Y& `& G0 a0 Esdcms.setsession "adminname",""
0 H3 u7 f$ U7 [: Z: f! Z) m. t9 J
/ i$ a* |- M: xsdcms.setsession "admingroupid","" _& Q" P6 {7 R5 N
$ d& c* Y* Y! F5 I) dsdcms.setcookie "adminid",""& l, P. {1 I& u0 d: J- w, p
6 L8 E) b# ~7 \) J
sdcms.setcookie "loginkey",""& z b* B, i2 }) v% _& t7 s0 R
, A* W4 d8 E6 e2 k2 `) s
sdcms.setcookie "islogin",""
. M9 E* i+ ]/ C) X
2 [1 V. n0 |( E7 ?2 X$ _1 H) Jsdcms.go "login.asp": v2 j* F, N& Q/ t+ m# f
4 P% Y+ z4 s) s" v4 lend sub( n# h, t0 H9 x+ V: h
( |! U* C# y- @+ J
6 D! {/ W2 i" {: u. J利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
# s/ @) M4 \7 V9 l3 L修复方案：
9 j X9 }$ z) Y) B' Y3 D修改函数！
2 L H9 a1 l( W! L% g2 f# p9 R! m |
发表于 2013-7-26 12:42:43
收藏
支持
反对