SiteServer cms Cookie Spoofing

. The SiteServer cms on the net platform has powerful functions but has many problems. The cookis found to be a test, in version 3.44 and later versions, a local environment is created, and then the system logs in to capture and manage cookis, and then deletes the Administrator account and password, and clears cookis. during login, it is found that the cookis value is changed only by useradmin = admin. this is the current account. Therefore, it is bold to judge that cookis is should be assigned a fixed value named worker Rong. VC. ADMINLOGIN = 6887; SITESERVER. ADMINISTRATOR. AUTH = login; SITESERVER. ADMINISTRATOR. USERNAME = admin; lzstat_uv = 28995594273945333853 | 677603; then the test finds that cookis can be spoofed to log on as long as the USERNAME = admin target site does have an administrator admin.


Then, I continuously tested several versions 3.44 and found that, as described above, the correct useraaname = Administrator Account cookis can fool the log on to the background file management office and cannot upload aspx. However, you can create a trojan at any time during the creation process. the kitchen knife is completeSolution:Encrypted and encrypted filtering ,,,,,,,