Espcms V5.6.13.04.22 UTF8 official background logic verification error vulnerability 2/N

There is a problem with the system background Permission Logic verification, resulting in a backend module function being bypassed and unauthorized access

The background administrator permission is verified in the file \ public \ class_connector.php:

 

function admin_purview() {  if ($this->fun->accept('archive', 'R') == 'filemanage' && $this->fun->accept('action', 'R') == 'batupfilesave') {    $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'G');   $esp_powerlist = $this->fun->accept('esp_powerlist', 'G');        $gettype = false;  } else {   $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'C');   $esp_powerlist = $this->fun->accept('esp_powerlist', 'C');   $gettype = true;  }   $arr_purview = explode('|', $this->fun->eccode($ecisp_admininfo, 'DECODE', db_pscode));   $this->esp_powerlist = explode('|', $this->fun->eccode($esp_powerlist, 'DECODE', db_pscode));   list($this->esp_adminuserid, $this->esp_username, $this->esp_password, $this->esp_useragent, $this->esp_powerid, $this->esp_inputclassid, $this->esp_softurl) = $arr_purview;  if ($gettype) {   if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_AGENT) != $this->esp_useragent || md5(admin_ClassURL) != $this->esp_softurl) {    $condition = 0;   } else {    $condition = 1;   }  } else {   if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_ClassURL) != $this->esp_softurl) {    $condition = 0;   } else {    $condition = 1;   }  }  if ($condition == 0) {    if ($this->fun->accept('archive', 'R') != 'adminuser' && $this->fun->accept('action', 'R') != 'login') {    header('location: index.php?archive=adminuser&action=login');    exit();   }  } else {    if ($condition == 1 && $this->fun->accept('point', 'R') == '' && $this->fun->accept('archive', 'R') == '' && $this->fun->accept('action', 'R') == '') {    header('location: index.php?archive=management&action=tab&loadfun=mangercenter&out=tabcenter');    exit();   }  }

Problems with logical Verification:

if ($condition == 0) { if ($this->fun->accept('archive', 'R') != 'adminuser' && $this->fun->accept('action', 'R') != 'login') {header('location: index.php?archive=adminuser&action=login');exit();}

When archive = adminuser but the action variable is not the same as login, the logon page is not displayed. But in the file adminsoft \ control \ adminuser. php

function onlogin() {  parent::start_template();  if ($this->fun->accept('logoutid', 'C') == 1) {   $this->ectemplates->assign('systemTitle', $this->lng['adminuser_login_lout_error']);   $this->fun->setcookie('logoutid', 0);  } else {   $this->ectemplates->assign('systemTitle', $this->lng['adminuser_login_login_error']);  }  $this->ectemplates->display('login'); }  function onlogin_into() {  include_once admin_ROOT . '/public/class_seccode.php';   list($new_seccode, $expiration) = explode("\t", $this->fun->eccode($_COOKIE['ecisp_seccode'], 'DECODE'));  $code = new seccode();  $code->seccodeconvert($new_seccode);  parent::start_template();  $db_table = db_prefix . "admin_member";  $linkURL = $_SERVER['HTTP_REFERER'];

You can also call other methods of this class, such as onlogin_into ()


Http: // 127.0.0.1/adminsoft/index. php? Archive = adminuser & action = login_into

That is, other functions of the admin user. php background file can be called.

Solution:
Logic Verification