易思ESPCMS设计缺陷可登录任意账号

- AV AC AU C I A
发布： 2025-04-13
修订： 2025-04-13

### 简要描述： 易思ESPCMS某处设计缺陷（验证过弱）可登录任意用户账号 ### 详细说明： 易思ESPCMS cookie存在设计缺陷 我看下cookie都有哪些参数 ``` ecisp_home_seccode ecisp_member_username ecisp_member_info ``` ``` function member_cookieview($keyword = false) { $retrunstr = array(); $retrunstr['username'] = $this->fun->eccode($this->fun->accept('ecisp_member_username', 'C'), 'DECODE', db_pscode); $user_info = explode('|', $this->fun->eccode($this->fun->accept('ecisp_member_info', 'C'), 'DECODE', db_pscode)); list($retrunstr['userid'], $retrunstr['alias'], $retrunstr['integral'], $retrunstr['mcid'], $retrunstr['email'], $retrunstr['lastip'], $retrunstr['ipadd'], $retrunstr['useragent'], $retrunstr['adminclassurl']) = $user_info; $retrunstr['userid'] = intval($retrunstr['userid']); $retrunstr['integral'] = intval($retrunstr['integral']); $retrunstr['mcid'] = intval($retrunstr['mcid']); return !$keyword ? $retrunstr : $retrunstr[$keyword]; } ``` ``` function in_center() { if ($this->CON['mem_isucenter']) { include_once admin_ROOT ....

0%

漏洞利用/PoC

暂无可用Exp或PoC

受影响的平台与产品

当前有0条受影响产品信息