SDCMS后台绕过直接进入漏洞

admin

要描述：

0 ]0 u; v+ V/ R- E8 O# h5 PSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
5 r& |! W. h- n5 S9 {
5 E4 \; @# u6 W0 ]1 Ndim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
9 E+ H5 W% z9 ^) p% l/ [- M2 ^& N
% `$ m) J3 d) T5 W' W8 It1=sdcms.loadcookie("islogin")
. g$ e9 p5 w9 t) q8 \; U
* B# O# S' S4 `; B6 j6 z) Qt2=sdcms.loadcookie("loginkey")
3 z) Q. c- L- B
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

9 u, B, d* ]( R5 J1 a5 G5 {//

sdcms.go "login.asp?act=out"
; o# W! F6 `4 ~& J. e
2 S  Z  V" E4 n* V* I: Kexit sub
' U% J9 f3 n2 \. S
else
1 h# Y& c6 P& ], l8 M( S" ~
dim data
6 }/ ^: b, d- d' b( I6 U" t
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

sdcms.go "login.asp?act=out"

exit sub

* [) {2 F5 J; T2 t0 V- G8 nelse

& }0 \8 Y  e% _$ m  U. eif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
* O, ~. n; ]* t4 g/ i
exit sub
: S8 ?9 G  B" j" a4 d/ T
4 P. @3 O3 Z# S5 \else

: q. a% T- A* \$ j9 q$ J3 P6 }8 c+ d6 W# oadminid=data(0,0)
% n9 z1 [6 |0 ?# t" L& o' L5 x
adminname=data(1,0)

9 Y& X  n3 \0 I7 x; r+ O; ^admin_page_lever=data(5,0)

' x, i2 X# t" }8 U# h3 K6 g, h8 Z$ Gadmin_cate_array=data(6,0)
4 p0 d) \0 {( ^6 }
admin_cate_lever=data(7,0)
* P/ p# m8 W3 r: O
( T9 o  f: I" h, O7 jif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

& \) i$ K4 J6 U& aif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
$ m7 `( O4 y) ]- C1 X
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

. \  H- V! m' T( g3 Yif clng(admingroupid)<>0 then
0 z- f# f- v5 p  v/ J/ j
admin_lever_where=" and menuid in("&admin_page_lever&")"
! K  Z0 }( e2 v3 j5 {: P& o
end if
: V7 j/ \! l9 J3 ]- s
2 i: M7 l% G/ i/ xsdcms.setsession "adminid",adminid

: }- D! Q- {! M2 t' y, Isdcms.setsession "adminname",adminname
% B; O. |& `/ }/ E( d. ]3 @
7 z4 [' a$ ^* B: c4 W- ^sdcms.setsession "admingroupid",data(4,0)

, @  e. d; s$ `3 ?8 wend if

end if
% q- Z$ m; o1 r$ K3 K! ~
end if

else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
  w8 y$ V$ o! }; B& {
if ubound(data)<0 then

4 I+ |1 n) W& k" ?4 j  m2 {. Esdcms.go "login.asp?act=out"
4 H6 h% _2 n' g+ e
exit sub

else

admin_page_lever=data(0,0)

5 @# \& a4 N0 y6 Radmin_cate_array=data(1,0)
2 b4 b7 g& ?4 I1 y$ y# ~9 h7 B# y5 E
" R. [" G. l: T& R. x" P6 l% vadmin_cate_lever=data(2,0)

) {/ o6 z9 u, C- y; jif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
# P4 B! q1 ~8 C. [( V0 Z
7 R, J# w0 B2 J. Bif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
6 ]9 ]1 ]1 C! }# B7 n( p* M2 ~
if clng(admingroupid)<>0 then
6 S8 r1 G# q; u. |
admin_lever_where=" and menuid in("&admin_page_lever&")"

9 i% R9 s) L& O8 p. l) G2 ?end if
) f7 U! B2 u) k8 m+ H
! R7 Q3 ^! w; {3 H+ }& Nend if
4 Q& u3 h, U9 A7 h* @. N& m* g
: T" g7 h) E7 Q2 i6 [0 N9 H" Zend if
' }, w6 P: E9 `; L: J
end sub
( W$ I9 {8 r$ Z% b漏洞证明：
( o& I8 p/ v( t- B1 J, [8 i9 S看看操作COOKIE的函数

public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

9 H! b/ b2 _9 tend function
: s" I+ X! E& W7 r6 N: p5 D
public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1

: m& a- S9 Z# K1 H6 N5 p: Vend sub

prefix
7 h/ O$ D# _( h8 ?1 G1 U1 g
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
+ m. P8 N- D3 }: Y3 t
: d/ H4 H4 i8 m2 S4 ^dim prefix

prefix="1Jb8Ob"

9 N! f! f8 A/ z7 {! ^'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
* v$ K4 H  }. p- \) B+ `
* S; b$ h- m5 k- M2 Y6 Usub out

& g4 ?: p; B9 a7 T, Hsdcms.setsession "adminid",""

1 V; A- O$ o/ q, csdcms.setsession "adminname",""

6 W- g* _5 i0 |( }" Vsdcms.setsession "admingroupid",""

7 y0 l) X- Z) r7 f5 U/ E1 l# Nsdcms.setcookie "adminid",""
3 v$ C; B& I: {% i. ^
sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

+ h$ A8 x2 M3 q7 h" hsdcms.go "login.asp"

: e3 N5 D" \2 N& ?! iend sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
, O8 W( h, ~5 I5 h, q( Q! }修改函数！