SDCMS后台绕过直接进入漏洞

admin

要描述：
- ?6 R& i$ F$ u
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
# R) N2 h1 z) h1 v详细说明：
1 L/ ?- @( I7 o6 B, p% N" gIslogin //判断登录的方法
& o0 h  ~2 `4 `1 a* |
sub islogin()

" z2 A$ J9 I! |* H4 Wif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
. J0 j. d# r# y% D
: E( p# c! h1 Q8 t) Udim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
+ D& x" o5 |5 y' Q8 l7 l
, a5 d5 I0 y2 t3 v" Y4 |t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
6 t% A% y$ a3 J
+ H% u, R1 F8 z5 x5 ~, R, x- \. Cif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
0 C+ e( q6 O# M! x2 o6 i
//
' Z! k# e0 ~' C, D& _1 O) B
9 i" K; d% J1 v- Qsdcms.go "login.asp?act=out"

exit sub
% W7 }  ^9 c: o- B0 Q6 ^1 f- L
else
: E& F0 K. j4 A; {$ Y
dim data
% \. c3 f" `; I+ [2 s
  C' v( G3 X+ {7 d6 \3 p. X' o, cdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
  G0 M( l8 H8 ^% b7 u8 J% v
8 E( ~7 o* \% @( ?if ubound(data)<0 then

1 W2 L* b7 P, _. [! F5 asdcms.go "login.asp?act=out"
" m0 g7 v" o  c& H' I) z) Y6 O
exit sub

* K  z+ E0 K# D4 k2 V  P; uelse
* g" p% H- C, U/ C, s2 p. u
# V" Q- I  W( c% X, p. T2 P( qif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
% w! ]0 ]9 `, E3 T' E8 e  n# @" B
sdcms.go "login.asp?act=out"

exit sub
# C7 S. m4 x! k- b# `% F0 f8 ]
- \% r/ L$ @7 a4 ?else
7 O: k! s  ^8 ]% l6 G
adminid=data(0,0)
: j# O3 ~- i& Q  N# b/ E, j
adminname=data(1,0)

# X: k' i1 H3 z6 x0 _( p2 I1 m, Qadmin_page_lever=data(5,0)

/ D5 y6 \7 X( y* Wadmin_cate_array=data(6,0)
' ]: O$ v. i2 @  c
. ~! j/ P, R+ F  `0 a* Madmin_cate_lever=data(7,0)

& @- _8 t3 ?" I8 @/ p; {- _1 l9 J  Vif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
! T1 n& u+ K; e, _1 `. K: L* f
: m* m. `. y$ f( v; Aif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

8 s- t! }# f3 \! K6 Y/ m: Uif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
! Z1 V" i# H, ?2 F& r
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
! V* @; [# b  n- x
end if
# A6 [7 @4 l8 F5 [
. h% }* G" P5 \sdcms.setsession "adminid",adminid

. d) p3 ^2 d) L3 m; asdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
* ~7 q$ G: l0 _& ~- P1 R
end if

end if
6 o- g% u/ X# V9 N9 f0 N
* j' f1 C4 u' V. G8 Mend if
# m0 T* j/ @$ M. v9 ]/ t9 m  T
else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
2 u  D* S  ^0 Q9 p  P
5 t+ ~5 l& y& y7 ~1 v; X8 yif ubound(data)<0 then
% \% _6 q0 I4 a& n, C) ?
4 n  |- w9 ^  Ysdcms.go "login.asp?act=out"
8 N) v( V6 i' b# j1 X
4 _( ~: M, Y5 C/ {8 R) Q$ B8 Yexit sub

else
) ?9 y8 J. O, P  }0 |
' x7 W5 c& d. a) D! |. E/ Nadmin_page_lever=data(0,0)
0 `4 U+ D% A. m1 ^5 A$ a
+ `3 v! A3 {6 m2 ]8 G% Nadmin_cate_array=data(1,0)

; r/ F$ H2 Z* Zadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

3 d; G/ f2 |: T, y5 L. w" D7 yif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
, P' L4 g1 M- u  }- b
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
; r+ M* v0 W% d9 [& n/ D* |# P
end if
4 [' i4 m* J' f" @% l- y
end if

: |3 Q- ^: ?' N; s4 K* g% tend if
! _/ ]1 m, r) m) c
% Q  L1 \- b! {$ u- g6 iend sub
' o: a) h. p. c% L& C1 U漏洞证明：
看看操作COOKIE的函数
/ S5 c& o( s0 U8 r; Q% r
8 x: n: I6 J, i2 H5 c& Opublic function loadcookie(t0)
+ R  K* b9 K8 J5 a$ X; `, q
7 L- }2 ^1 t* _/ b# {8 J6 x/ q) |loadcookie=request.cookies(prefix&t0)

% f* q7 N  m$ N. a7 t) Zend function
* C; i% c% E, N
. Q8 P# Z) ]% c9 N* f6 }4 _7 i5 xpublic sub setcookie(byval t0,byval t1)

/ p- e- i: C% C( e1 [8 _& fresponse.cookies(prefix&t0)=t1
7 L! ^- C, \0 {; Y0 n
end sub
/ H6 ^- J; t/ ]& `) C
prefix
& d) ^2 f" L; Z7 C9 D& ^/ ]
) l# C% h& n; V$ a8 v'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
# K; X+ b" @  h! W: a- i
dim prefix

prefix="1Jb8Ob"
: }. b4 L/ z4 H. ]
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
0 \+ f3 J2 V1 Y* l% i! }
sdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
1 l0 P/ c5 M# S7 Q  m' `  {
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
+ c$ m& i. z) ^; Y; g7 _: c3 y- X
sdcms.setcookie "islogin",""
( \6 b$ x8 W5 i6 L, n) e& n4 @( J8 ~
sdcms.go "login.asp"
/ w# q) }* L+ j* b. a: E% N) S6 V
end sub
+ w3 q* P/ ?7 X4 _3 }

0 c9 F( B) ]" n! W! O3 G. D0 X% g3 Q利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
8 l+ ]3 {2 m; ~2 \" ?. C* |( K修复方案：
$ m% P0 J; w5 D) r6 C& ~修改函数！
$ v2 Y) d" X4 E5 r