虽然验证码进行了加密，但是逻辑上还有点问题

问题出在

..\includes\cls_captcha.php

通过验证函数可以看到直接返回，并没有对验证失败进行处理
    function check_word($word)

        {

            $recorded = isset($_SESSION[$this->session_word]) ? base64_decode($_SESSION[$this->session_word]) : '';

            $given    = $this->encrypts_word(strtoupper($word)); //MD5加密处理



            return (preg_match("/$given/", $recorded)); //验证规则

        }
 

    if (intval($_CFG['captcha']) & CAPTCHA_ADMIN)

        {

            include_once(ROOT_PATH . 'includes/cls_captcha.php');



            /* 检查验证码是否正确 */

            $validator = new captcha();

            if (!empty($_POST['captcha']) && !$validator->check_word($_POST['captcha']))

            {

                sys_msg($_LANG['captcha_error'], 1);

            }

        }

        $_POST['username'] = isset($_POST['username']) ? trim($_POST['username']) : '';

        $_POST['password'] = isset($_POST['password']) ? trim($_POST['password']) : '';

        $sql="SELECT `ec_salt` FROM ". $ecs->table('admin_user') ."WHERE user_name = '" . $_POST['username']."'";

       echo $sql."<br/>";

        $ec_salt =$db->getOne($sql);

        if(!empty($ec_salt))

        {

             /* 检查密码是否正确 */

             $sql = "SELECT user_id, user_name, password, last_login, action_list, last_login,suppliers_id,ec_salt".

                " FROM " . $ecs->table('admin_user') .

                " WHERE user_name = '" . $_POST['username']. "' AND password = '" . md5(md5($_POST['password']).$ec_salt) . "'";

        }

        else

        {

             /* 检查密码是否正确 */

             $sql = "SELECT user_id, user_name, password, last_login, action_list, last_login,suppliers_id,ec_salt".

                " FROM " . $ecs->table('admin_user') .

                " WHERE user_name = '" . $_POST['username']. "' AND password = '" . md5($_POST['password']) . "'";

        }

        $row = $db->getRow($sql);



        if ($row)

        {....}

本文来自: 蜗蜗侠's Blog-关注网络安全 http://blog.icxun.cn/hack/Code/399.html