SDCMS后台绕过直接进入漏洞

admin

要描述：

+ K, y) n" v8 FSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
; k% ?2 L9 n6 S8 [
sub islogin()
  d2 V0 Y  p. o% }1 d+ t( l
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
; g' C" @+ ^- Q2 z9 @
dim t0,t1,t2
* j6 g+ {2 b" Q; A1 r8 Y
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
+ q3 s6 t! H% T+ ]
t1=sdcms.loadcookie("islogin")
. ^# J5 F* _6 X" h; c
t2=sdcms.loadcookie("loginkey")
) H+ a" B) N# l# p
% A; T) N0 l5 ~2 i6 M2 k# g  r4 `" aif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
% o$ O4 [" A! a1 x5 e5 E( Q
//
* k" }$ j# ~+ x9 `0 [( X4 k* t
sdcms.go "login.asp?act=out"

4 ^4 u9 X& C' C5 u3 Pexit sub

else

) ]$ g5 ]. d7 v% K- qdim data
" F* J% `: ]+ j8 k2 J, b
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
. d: }2 I) s! `  Z
if ubound(data)<0 then
1 Q( g2 o+ h- [" Z) }
sdcms.go "login.asp?act=out"
+ j0 C( n* \9 s7 W+ q( ~
exit sub

else
( v$ x2 G2 Q: S2 R; U  p
# T) T9 ^- F0 ?3 M! Qif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
$ X- v/ o2 e! ^; v0 J* Y
9 m9 g6 j) X, {4 V: h( s. y, Gexit sub
% Z$ E  F0 o6 w+ B0 ~
else

7 p' ~+ N' [' q4 P' t% Cadminid=data(0,0)
- i* I& j  A2 a) Y* `
adminname=data(1,0)
# _; l5 [+ {! I' ^& f5 [
; }" z! G/ A8 k+ i; Y% ]9 Radmin_page_lever=data(5,0)

admin_cate_array=data(6,0)
* `+ Q& v8 V3 d4 F- H) ]$ B
admin_cate_lever=data(7,0)

& m, ]8 R6 N) y2 A# w. A) xif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

' o. U2 r2 W* J6 [: fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
8 N# V. M. C! Z2 _7 I
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
  Z: z1 K3 W& Z8 ?  v& n
if clng(admingroupid)<>0 then
  T3 k- U/ ]6 q' ~% @
admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
) C8 e" n; j; K9 O$ ?
  ^* A7 K1 t- l$ A( \- Esdcms.setsession "adminid",adminid

% f2 {! ^: t5 s% y, l% lsdcms.setsession "adminname",adminname
/ z. x: Z' m  t
sdcms.setsession "admingroupid",data(4,0)
! D0 C- a/ h3 k9 w5 W
! u: P/ ~' Y; b- dend if

end if

end if

$ F3 C% M0 W0 b& Z/ Pelse
" V  x, N' E+ }' H
. w# v. l5 J: {( e* j7 Udata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

4 v  B2 Y* i" [* F! H& B" Qif ubound(data)<0 then
, N' E! K$ q' u: Q- ^. d; I
sdcms.go "login.asp?act=out"
) {, \; K4 v" L1 E6 b# ]- @
exit sub

! t& L7 Q% }0 ?; Aelse

1 B! h& g9 h( D, Wadmin_page_lever=data(0,0)
5 w$ k- W1 m% `
admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)
+ k: ^7 ]( s) y6 o" b, ]' O
, [6 B7 |3 ~* Z7 v4 m" `% Tif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
7 S3 d+ P  Z; Y/ g3 e6 ?" _) D2 W9 n
5 P* n3 D* n7 z+ {if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
4 q% [: r  B- y
3 A5 ^% [% s+ {if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
* c% @' z* a! t6 Z
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
; j* t  H( k* D. _  Y
end if
, Q2 Q; s% C& u% P) Y
$ c$ j0 r( G. B; u; W/ v( o; |end if
  K7 k) m. z+ ^
6 |+ s* T$ @% T) Iend if
9 J' R- |& @4 c9 P
end sub
漏洞证明：
" K8 \  ?; r1 A/ N$ _2 [看看操作COOKIE的函数

public function loadcookie(t0)
( x5 E, T7 M2 s5 u) u! C0 B
loadcookie=request.cookies(prefix&t0)

end function

6 J# o0 k6 l* W3 e+ ipublic sub setcookie(byval t0,byval t1)

! ^* B( N6 }) p! G& z8 i' iresponse.cookies(prefix&t0)=t1

  x# S4 h" x( x: u: Y+ xend sub
+ s6 b3 X' x# r5 O) N$ x# [7 s& Q
/ R' e: T  {" _: _1 C$ d/ ]prefix
, J- }* b& x$ A# v
( G0 C. m: [' N! C8 C! ~'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix

prefix="1Jb8Ob"

* L( h. x  S( X/ d7 ^% I/ J0 W, ['这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
0 I1 q+ L6 `9 ^
sdcms.setsession "adminid",""

# P" J( r8 B" u( ^* c4 |sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
' S5 {6 I0 k- q7 b0 q2 @
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

8 v! e# ], a! j) W4 esdcms.go "login.asp"

# t; ?7 |+ p* K# Send sub

* W8 u7 ~; k7 G" \
2 T: m, T; D, d0 F( ]利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
1 d# w2 D+ J: y. r7 K修改函数！