Aspcms arbitrary User Password Reset and repair solution

Some pages of the aspcms member center have defects in user verification. After modifying the cookie, you can submit it to reset the account information of any user.


'Member/reg. asp
Dim action: action = getform ("action", "get ")
If action = "reg" then
AddUser ()
Elseif action = "editpass" then
EditUser ()
Else
EchoContent ()
End if
'Row 3-10 accepts a get request. If the action is editpass, The editUser process is executed.
Sub editUser www.2cto.com
Dim LoginName, userPass, reuserPass, Email, Mobile, Address, PostCode, Gender, QQ, TrueName, Phone
LoginName = trim (rCookie ("loginName "))
UserPass = getForm ("userPass", "post ")
ReuserPass = getForm ("reuserPass", "post ")

Email = filterPara (getForm ("Email", "post "))
Mobile = filterPara (getForm ("Mobile", "post "))
Address = filterPara (getForm ("Address", "post "))
PostCode = filterPara (getForm ("PostCode", "post "))
Gender = filterPara (getForm ("Gender", "post "))
QQ = filterPara (getForm ("QQ", "post "))
TrueName = filterPara (getForm ("TrueName", "post "))
Phone = filterPara (getForm ("Phone", "post "))
 

If userPass <> reuserPass then alertMsgAndGo "the two passwords are different", "-1"

Dim passStr
If not isnul (userPass) then passStr = "[Password] = '" & md5 (userPass, 16 )&"',"
 
Conn. exec "update {prefix} User set" & passStr & "Email = '" & Email & "', QQ = '" & QQ &"', mobile = '"& Mobile &"', Address = '"& Address &"', PostCode = '"& PostCode &"', Gender = "& Gender &", phone = '"& Phone &"', TrueName = '"& TrueName &" 'where LoginName =' "& LoginName &" '"," exe"
AlertMsgAndGo "modified successfully", "editPass. asp"
End Sub

'Row 24-47 is the editUser process.
'It can be seen that no verification is performed on the user's password modification, and the cookie value can be modified.
'Change the LoginName value to admin. Submit the modification to reset the Administrator information.
'This problem also exists on the userinfo. asp page.

 
 
Solution:

External submission to enhance user verification


By viekst