智睿管理系统修改管理任意密码漏洞后门

漏洞出在Admin_Passod.asp文件，

<!–#include file=”../Include/conn.asp”–>

<!–#include file=”../Include/md5.asp”–>

<%

response.expires = 0

response.expiresabsolute = now() – 1

response.addHeader “pragma”,”no-cache”

response.addHeader “cache-control”,”private”

Response.cachecontrol = “no-cache”

‘========判断是否具有管理权限

%>

<html>

<head>

<meta. http-equiv=”Content-Type” content=”text/html; charset=gb2312″ />

<title>无标题文档</title>

<link href=”images/Admin_css.css” type=text/css rel=stylesheet>

</head>

<body>