SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
1 M1 s& M* u# _Islogin //判断登录的方法

& ~3 u( N( u, Zsub islogin()
% [" Z% y- E- L5 `8 N: N
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

9 c! {) N! j7 ?# R( f5 Cdim t0,t1,t2
3 n+ z2 C1 F! n4 r# Q5 J5 j
! A/ e& T: b# j1 p7 y2 ]! dt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

! ]/ f  j% H" P3 S9 zt1=sdcms.loadcookie("islogin")
- A0 t. y4 ?* b8 ?! c
t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//
! W# J- Y7 t1 k; b' F1 V" I6 s
/ A" ?+ @  o3 P: t. Bsdcms.go "login.asp?act=out"

% i! Y( q, F$ y5 T9 ^exit sub

1 R8 }9 [/ H$ q- j' [else

. M( F% h' t; \5 t' Q7 ^2 S6 z! {8 P2 Cdim data

; ^: L& O/ ~0 h2 k$ ]data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

0 m- {- G# @/ f& bif ubound(data)<0 then

sdcms.go "login.asp?act=out"

2 r# U/ z6 V4 ?% ^' X. S, rexit sub
( R; U7 c  y7 Z- @0 _
else

3 {/ f2 J* F7 Bif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
2 n! n% ]6 D6 R1 u" E5 b8 K
+ d8 a3 u2 ]! W8 d2 ]! \1 p4 isdcms.go "login.asp?act=out"

exit sub

else

3 i) I1 @& B5 X6 J' }6 N; S: hadminid=data(0,0)

adminname=data(1,0)
6 n4 G5 B  }  D* u* U" }
admin_page_lever=data(5,0)
- C7 v& P" |) u/ K  g0 w
admin_cate_array=data(6,0)
6 z* m# C. i& T5 o+ D
$ y# h+ }. D8 q! k  sadmin_cate_lever=data(7,0)

( t, ]+ y. H) J& c# sif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

( i; t& q- O' P7 z3 u/ Z$ @if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
& M# e4 Q4 D* E( l* l
end if
# Z% ]. r/ W8 l2 Y8 F' ^
sdcms.setsession "adminid",adminid
3 w  ^, H2 F. \2 L' }) Q9 y) d
sdcms.setsession "adminname",adminname
& H( d: A2 E' T8 }7 F
3 A# _+ }6 C9 c/ m6 k" Asdcms.setsession "admingroupid",data(4,0)
0 W( @0 P+ e7 u; _9 V' h% I- H
8 A& m9 x( J9 F- ~3 k* v* H/ dend if

- {5 N2 j# i; F: W1 z4 o5 j$ rend if

end if
' ]  g0 R* w7 w
else
9 V6 p: d) i$ k9 |$ G; R( a. B
" R. b3 H% ?1 F+ U. t: jdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
- Q8 E5 T/ l# L( \  M
# y4 k: j, h' j1 F6 t4 O  \3 ~if ubound(data)<0 then
0 _) e1 _- }) U3 K# c
sdcms.go "login.asp?act=out"

exit sub

else
" j( f9 C! n4 h  {: C* e
admin_page_lever=data(0,0)
5 u3 Q8 C' d7 c+ v$ r$ T
admin_cate_array=data(1,0)

+ o% b8 ]3 ^7 f! c( m4 X8 }* J3 [admin_cate_lever=data(2,0)
# j* M: |% D& y& N' t
- Z4 Y  n  ~- K/ C# E% Q& jif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
) n8 x& H: `4 A( h1 A3 q! E+ t3 X& K
4 N4 g' {$ u8 H; c3 @if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
0 H. B2 u  I- a- Z
2 p7 D2 O) u8 S# \0 Zif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

4 t. z) i, v" X: w& z3 d& i9 P& Eif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
$ J9 ]. o% R. M. `6 P7 |$ }% t
9 ~2 {( h, b" dend if

end if
" }7 o; `6 M$ Q9 S7 ~+ Q5 I9 K9 U
7 p8 |5 [  H, i4 _end if
0 X) ~5 i8 ~+ G& P: I1 q. l
end sub
漏洞证明：
) E0 e; u$ l! O9 u0 l. t看看操作COOKIE的函数
& @6 o8 g2 M6 R. f) |, r, M
public function loadcookie(t0)
; }* i4 }3 I5 A3 w- h& i. ?
, K* s8 l" [3 k6 Iloadcookie=request.cookies(prefix&t0)
/ d4 u9 H; {5 Q1 x% K
end function
6 l* @4 U* P) Z$ H( f) m
public sub setcookie(byval t0,byval t1)
( c  N& L2 s5 m: `/ V3 y% B
$ {" W  ~2 y: s$ k8 F- B8 nresponse.cookies(prefix&t0)=t1
. H. p$ e( _- X% c9 h3 a2 X, \6 r
% \5 ?: H) N, o8 B7 X# K3 Aend sub
" A6 ~* G1 f6 i/ G& ^5 G
prefix
( @4 Q! ^9 t) l- I7 Q. K
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix
# t, a% b! J" A, y
! H- r2 f. ^% D! G. Hprefix="1Jb8Ob"

& E# u3 {! w- I5 |8 f) G'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

, O6 Q, |; |4 _5 r6 m2 v/ xsub out
, O! \) n6 A2 r8 u2 B; q) F/ X
( C9 c6 y. ^+ {: Csdcms.setsession "adminid",""

sdcms.setsession "adminname",""
+ s2 c& y4 r3 ^+ W. L
+ M# z# l1 L5 y2 x2 a0 fsdcms.setsession "admingroupid",""
& j7 [  q: k, g+ R; ]3 z: A
& [2 ^0 Y1 W1 c8 w  psdcms.setcookie "adminid",""
2 d4 [9 j# j2 m0 v' G8 g$ d
sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""
  f6 Z6 t+ s4 X
" P6 m4 l$ v' Q8 U; _8 xsdcms.go "login.asp"
* ]+ r# c! f6 {: `* j0 D
) t  _# V/ m+ i* w% F* s8 cend sub


% [7 E* o2 Q9 b% Y( C. w0 N5 ^利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！