Background spoofing and repair of the latest 2.8 version of mofei chongtian news management system

Brief description:

The management files in the background only perform cookie verification. You can perform cookie spoofing on a remote client to obtain the management system permission.

Detailed description:

<%
 
'Permission settings // verification authority section, which only verifies client cookies
 
If request. cookies ("mofei") ("mofeiname") = "" or request. cookies ("mofei") ("mofeiid") = "" or request. cookies ("mofei") ("mofeiip") <> Request. servervariables ("REMOTE_ADDR") then
 
Response. redirect "show_error.asp? Eid = you are not the administrator of www.2cto.com! Check whether you have the permission! "
 
End if
 
If request. cookies ("mofei") ("banid") = "ban11" then // related management operations
Proof of vulnerability: Use a browser or browser plug-in with the cookie modification function, change the local cookie to "mofei = mofeiid = 1 & banid = ban11 & banid5 = ban115 & mofeiname = mofei & mofeiip = 127.0.0.1" and access the management page. that is, you can manage permissions for related operations, including operations and management accounts, backup site databases, and so on...


Solution:

Add other remote server permission verification methods
Author: Yu Ren @ wooyun