记录黑客技术中优秀的内容,传播黑客文化,分享黑客技术精华

SDCMS 2.0 beta2后台绕过直接进入,一种不常见的设计失误案例

2013-07-25 11:15
SDCMS后台绕过直接进入:测试版本2.0 beta2 其他版本未测试

 

Islogin //判断登录的方法
sub islogin()
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
dim t0,t1,t2
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
t1=sdcms.loadcookie("islogin")
t2=sdcms.loadcookie("loginkey")
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
//
sdcms.go "login.asp?act=out"
exit sub
else
dim data
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
if ubound(data)<0 then
sdcms.go "login.asp?act=out"
exit sub
else
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
sdcms.go "login.asp?act=out"
exit sub
else
adminid=data(0,0)
adminname=data(1,0)
admin_page_lever=data(5,0)
admin_cate_array=data(6,0)
admin_cate_lever=data(7,0)
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
if clng(admingroupid)<>0 then
admin_lever_where=" and menuid in("&admin_page_lever&")"
end if
sdcms.setsession "adminid",adminid
sdcms.setsession "adminname",adminname
sdcms.setsession "admingroupid",data(4,0)
end if
end if
end if
else
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
if ubound(data)<0 then
sdcms.go "login.asp?act=out"
exit sub
else
admin_page_lever=data(0,0)
admin_cate_array=data(1,0)
admin_cate_lever=data(2,0)
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
if clng(admingroupid)<>0 then
admin_lever_where=" and menuid in("&admin_page_lever&")"
end if
end if
end if
end sub

 


看看操作COOKIE的函数
 
 

public function loadcookie(t0)
loadcookie=request.cookies(prefix&t0)
end function
public sub setcookie(byval t0,byval t1)
response.cookies(prefix&t0)=t1
end sub
prefix
'变量前缀,如一个空间下多次使用本程序的话,请每个程序配置不同的值
dim prefix
prefix="1Jb8Ob"
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
sub out
sdcms.setsession "adminid",""
sdcms.setsession "adminname",""
sdcms.setsession "admingroupid",""
sdcms.setcookie "adminid",""
sdcms.setcookie "loginkey",""
sdcms.setcookie "islogin",""
sdcms.go "login.asp"
end sub

 

 
利用方法:

设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台,就可以了! 
修复方案:

修改函数! 
 

知识来源: www.2cto.com/Article/201307/230724.html

阅读:177494 | 评论:0 | 标签:cms

想收藏或者和大家分享这篇好文章→复制链接地址

“SDCMS 2.0 beta2后台绕过直接进入,一种不常见的设计失误案例”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

ADS

标签云