SDCMS后台绕过直接进入漏洞

admin

要描述：
+ Y9 a8 O9 N& K
2 g5 K- m( ]1 A, ASDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
7 A; N2 R2 Z) w+ f+ P+ A5 }
sub islogin()

2 A4 y# R$ l" d0 v2 Uif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
" @4 w' n$ Z4 r4 r8 n
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")
+ l: S/ l! s# Y0 M6 T/ E' L6 t( T
4 E# {6 B8 q7 F' `5 M1 K/ ot2=sdcms.loadcookie("loginkey")

' m" H0 s* `2 q4 Mif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//
. P- c6 x" C4 S6 r
sdcms.go "login.asp?act=out"
9 y  k% }* ~; u
7 @' m8 d1 ^6 @5 N/ p- @exit sub
. e$ N: ?# e7 e& k* K
& @, g+ p! J0 i  eelse
  J9 n# w4 d" O" b5 E+ s8 q- h
dim data
/ S4 l9 t. J. l2 x% z; C" }6 X
  I( q4 K/ R) D5 L0 v6 C; d  i6 qdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

' X, `$ C# c' J8 s2 S0 m! bif ubound(data)<0 then
% F) J/ C4 K, T( @6 E
, }( ^0 m+ V$ A. E$ B5 `sdcms.go "login.asp?act=out"
7 u* Z$ K9 g- t( i
+ y( {% B% N2 G# lexit sub

" Y6 P, b. m; F9 D( W$ }else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
$ t6 C+ k% e0 m5 W$ v4 |0 q+ l
exit sub
# ]8 h7 F" b% d- j7 [0 }4 j
  f7 B# @1 M: a% xelse

; u5 H) h3 t/ radminid=data(0,0)
. X! s: n6 [2 e" x' T* i# t' p, j+ P; t
adminname=data(1,0)

admin_page_lever=data(5,0)
/ r9 S) N' o: l3 w! p7 o" z% O
admin_cate_array=data(6,0)
1 M* g" F  [% a. B) j, R$ h! B
admin_cate_lever=data(7,0)

/ t+ [9 x5 z, A$ c/ Mif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
) O9 u* k0 l9 x) ?2 e
, E8 p9 X# D& W- ?if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

! b! D, f, ~3 R2 ?: Xif clng(admingroupid)<>0 then
: m' n6 ]# g2 h) s, O/ C, ^5 p/ D5 J
9 h/ Y- C+ Y0 }- v3 z* @8 |admin_lever_where=" and menuid in("&admin_page_lever&")"

end if

8 d1 h9 O! H/ |# q% Ysdcms.setsession "adminid",adminid
& G8 r& d/ ]  n! }1 q' Z
- O  P: r1 T2 M% Osdcms.setsession "adminname",adminname

* _- M. Q" Q4 r: v4 M# ?sdcms.setsession "admingroupid",data(4,0)
0 z" v. E. |0 @9 T) Z  o% \
end if

end if
3 d0 D/ m# h8 f
. P7 k* \$ a! ?3 b3 k) n% }, k4 {end if

2 q8 m: L5 y- s: n7 I& L2 Kelse

4 u" [, r; q6 h4 w. \0 d4 B$ edata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
  b. V. y, w, X0 H& x
# q9 \* q7 }7 H( t4 J0 |' W; Oif ubound(data)<0 then

sdcms.go "login.asp?act=out"

exit sub

else
6 _* F% W, `$ @! ]- {; {
* ?" \: H6 d4 ~  O7 c. m2 Iadmin_page_lever=data(0,0)

admin_cate_array=data(1,0)

/ v1 t  V1 d  p/ X! Q% h: D8 q: xadmin_cate_lever=data(2,0)

0 b% \$ j2 d8 ~3 C2 pif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ m9 R; S' ^9 \' ]
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ ?+ _. T  W; H& b
if clng(admingroupid)<>0 then
: P8 a- q( W, @  z! [5 F8 b! \
admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
. C, ]' V, P4 _2 V1 ]
end if
# R3 ~" N4 h7 @) e6 I
end if

- G7 N# L5 e& Q0 ]end sub
漏洞证明：
# C) H3 B- O6 I& j看看操作COOKIE的函数

public function loadcookie(t0)
1 `$ n" j0 v' G6 T, r8 q3 s6 d
loadcookie=request.cookies(prefix&t0)

$ ]2 H4 [6 ~1 S/ Q/ E' ^" s) B6 Yend function

public sub setcookie(byval t0,byval t1)
; X( h: g( I, J6 a2 I5 w
response.cookies(prefix&t0)=t1
7 \$ O  t, B" W' K/ j; @
5 J3 _2 O7 V6 j. e7 w% hend sub
9 s! B( a$ D* @* q0 e5 X5 R7 i
prefix
- G. u, W- N7 X: A
$ x" ?  M- i2 b" ], g- J7 J3 m  z" U'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
. ~5 u# U- O' U# w, h7 ]  y
dim prefix

prefix="1Jb8Ob"
* A7 g) C3 Q* ^1 D; O' {
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
& H1 K7 X( u  a* \1 M4 [0 l" J
! @. u5 }, H: o6 O& `- V# nsub out
9 D  L/ C! v) F" _; E4 ?
4 h% h/ Q5 W4 @( psdcms.setsession "adminid",""

2 J# W1 ^+ Y- L; A; c- ?/ jsdcms.setsession "adminname",""
7 d8 t; N% I# h$ G5 g  w
sdcms.setsession "admingroupid",""
0 x# f0 {% q& J8 w( a
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
0 ]3 v# I+ Q$ {- @& ^
0 _1 m& T  [  `. D1 Vsdcms.setcookie "islogin",""
+ ?+ a8 {) g$ B  z" l" m- Y
sdcms.go "login.asp"
, l4 Q* E. D4 b; i) R
end sub
4 l4 ~: V5 j, N/ N* x/ X+ F
0 G  B. Q1 w1 L/ i  ^) h
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
  z8 L6 o- e' U3 Z) V1 k修改函数！