### 简要描述： 系统后台权限逻辑校验存在问题，导致后台某模块功能被绕过和非授权访问 ### 详细说明： 后台管理员权限校验在文件\public\class_connector.php: ``` function admin_purview() { if ($this->fun->accept('archive', 'R') == 'filemanage' && $this->fun->accept('action', 'R') == 'batupfilesave') { $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'G'); $esp_powerlist = $this->fun->accept('esp_powerlist', 'G'); $gettype = false; } else { $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'C'); $esp_powerlist = $this->fun->accept('esp_powerlist', 'C'); $gettype = true; } $arr_purview = explode('|', $this->fun->eccode($ecisp_admininfo, 'DECODE', db_pscode)); $this->esp_powerlist = explode('|', $this->fun->eccode($esp_powerlist, 'DECODE', db_pscode)); list($this->esp_adminuserid, $this->esp_username, $this->esp_password, $this->esp_useragent, $this->esp_powerid, $this->esp_inputclassid, $this->esp_softurl) = $arr_purview; if ($gettype) { if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_AGENT) !=...
### 简要描述： 系统后台权限逻辑校验存在问题，导致后台某模块功能被绕过和非授权访问 ### 详细说明： 后台管理员权限校验在文件\public\class_connector.php: ``` function admin_purview() { if ($this->fun->accept('archive', 'R') == 'filemanage' && $this->fun->accept('action', 'R') == 'batupfilesave') { $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'G'); $esp_powerlist = $this->fun->accept('esp_powerlist', 'G'); $gettype = false; } else { $ecisp_admininfo = $this->fun->accept('ecisp_admininfo', 'C'); $esp_powerlist = $this->fun->accept('esp_powerlist', 'C'); $gettype = true; } $arr_purview = explode('|', $this->fun->eccode($ecisp_admininfo, 'DECODE', db_pscode)); $this->esp_powerlist = explode('|', $this->fun->eccode($esp_powerlist, 'DECODE', db_pscode)); list($this->esp_adminuserid, $this->esp_username, $this->esp_password, $this->esp_useragent, $this->esp_powerid, $this->esp_inputclassid, $this->esp_softurl) = $arr_purview; if ($gettype) { if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_AGENT) != $this->esp_useragent || md5(admin_ClassURL) != $this->esp_softurl) { $condition = 0; } else { $condition = 1; } } else { if (empty($this->esp_username) || empty($this->esp_adminuserid) || md5(admin_ClassURL) != $this->esp_softurl) { $condition = 0; } else { $condition = 1; } } if ($condition == 0) { if ($this->fun->accept('archive', 'R') != 'adminuser' && $this->fun->accept('action', 'R') != 'login') { header('location: index.php?archive=adminuser&action=login'); exit(); } } else { if ($condition == 1 && $this->fun->accept('point', 'R') == '' && $this->fun->accept('archive', 'R') == '' && $this->fun->accept('action', 'R') == '') { header('location: index.php?archive=management&action=tab&loadfun=mangercenter&out=tabcenter'); exit(); } } ``` 逻辑校验存在问题: if ($condition == 0) { if ($this->fun->accept('archive', 'R') != 'adminuser' && $this->fun->accept('action', 'R') != 'login') { header('location: index.php?archive=adminuser&action=login'); exit(); } 当archive=adminuser,但是action变量不等于login时就不会被跳转到登录页。但是在文件adminsoft\control\adminuser.php中 ``` function onlogin() { parent::start_template(); if ($this->fun->accept('logoutid', 'C') == 1) { $this->ectemplates->assign('systemTitle', $this->lng['adminuser_login_lout_error']); $this->fun->setcookie('logoutid', 0); } else { $this->ectemplates->assign('systemTitle', $this->lng['adminuser_login_login_error']); } $this->ectemplates->display('login'); } function onlogin_into() { include_once admin_ROOT . '/public/class_seccode.php'; list($new_seccode, $expiration) = explode("\t", $this->fun->eccode($_COOKIE['ecisp_seccode'], 'DECODE')); $code = new seccode(); $code->seccodeconvert($new_seccode); parent::start_template(); $db_table = db_prefix . "admin_member"; $linkURL = $_SERVER['HTTP_REFERER']; ``` 还可以调用该类的其他方法，如方法onlogin_into() ### 漏洞证明： http://127.0.0.1/adminsoft/index.php?archive=adminuser&action=login_into 也就是可以调用adminuser.php这个后台文件的其他功能。
