ZDSoft website generation system vulnerabilities and repair

The ZDSoft website generation system has severe vulnerabilities, which can cause the website server to be directly granted the highest permission,

1. Background Permission Bypass Vulnerability
Http://www.zdsoft.net/admin/left.aspx background menu
If you have not logged on to the website, you will be redirected to the js logon page. If you disable js, you can continue to access the website. Some background files limit the permissions, but it is okay to modify the Website user password.
Http://www.zdsoft.net/Admin/sqlPlatform/operateSql.aspx
You can run the SQL statement here, so you do not need to log on.

2. http://www.zdsoft.net/Admin/sqlPlatform/sqlLogin.aspx
This is the SQL operating platform. In addition to the vulnerability bypass above, you can log on directly. The user name and password are fixed.
Username: sbwSqlAdmin password: sbwPass @ word1
Most of zdsoft website database users are sa, so this vulnerability is very serious.




Solution:
Response. end after js jump code