SDCMS后台绕过直接进入漏洞

admin

要描述：
6 \* I+ S2 P( a
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
5 u3 Z+ W* t8 E  Z( N. ~' L详细说明：
+ a7 z  q, M; b! S4 `Islogin //判断登录的方法
; \3 L7 d' d( P3 W
- B" w+ m3 d0 S* Fsub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
) M# g7 W+ h6 b$ \7 N
dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")
/ M* o- @0 {$ M; f) H
; l2 G8 m! \( }5 H; _9 V: gt2=sdcms.loadcookie("loginkey")
$ g2 T, p3 s) W' o$ a1 U" G$ B
7 D# ~" [) v# d2 _* Q) `if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

8 x# `$ X: f' N5 b0 l//

sdcms.go "login.asp?act=out"
. }5 `2 C# p) ]4 d. T3 X4 b
exit sub
' c0 n+ K/ S0 n- X1 ]7 v, A# M
else

dim data
* j2 k9 c* e0 d, P
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

# d4 R5 i4 [2 [( J6 G0 v! }if ubound(data)<0 then

4 R$ l* s* P2 _8 Lsdcms.go "login.asp?act=out"
$ F4 x1 C1 a/ x6 }4 _5 f4 t5 G' {' e! a+ d
exit sub
- ^1 o+ Q( [. ~/ T6 B
else
9 @' u5 |6 F5 _: }
4 F/ [* d, I7 ^5 v8 vif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
* K8 g* m! D6 S9 X9 h' G
7 e  r/ f+ Y" }$ G5 Mexit sub
, _! T+ @3 T9 b) i( _
else
& p% D' f0 X  X6 q$ A
adminid=data(0,0)

* }) N. c+ e% w/ t8 q4 E  |6 F$ eadminname=data(1,0)

2 @2 |7 B1 z, f6 a+ Iadmin_page_lever=data(5,0)
) M; _( R- J* B5 Z
: t$ S9 H  [: e: I# Eadmin_cate_array=data(6,0)

) [: G/ C( l$ _' wadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
' r) ^. a( D; u" A% n7 }3 m
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
+ q2 M" ~6 N3 z. H% z/ c8 Y
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

3 k# o6 `1 A9 E+ H8 k( E1 x' Aif clng(admingroupid)<>0 then

: M6 M0 E. I: v" C5 f- yadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

: z2 O  T# m7 [sdcms.setsession "adminid",adminid
% w7 a4 K* j, a, [+ B
sdcms.setsession "adminname",adminname
  b3 `3 D, b1 w  L+ _# w& t
4 w7 h! ?% S4 W7 b  r) s' Osdcms.setsession "admingroupid",data(4,0)
% ~! Q: A/ U* ^# \" b% \/ {+ \0 i, b- [
* P; {- r+ u7 K! @, K& ?end if
4 R% k) J1 r% T9 O# Y. @( }. u  B1 ]
end if

end if
2 z2 w* Z, _# h' m$ P
6 N8 B+ l% l. N  u5 z* Lelse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

  h) Q7 K7 ^) A0 f+ psdcms.go "login.asp?act=out"

* J5 U0 g3 d/ ^' Z) ]# N  e- Fexit sub

8 d6 ?' n$ L3 w5 k( ]else
/ a" @' b; t* `) h5 F
admin_page_lever=data(0,0)
# W2 V0 [6 v" p8 g
admin_cate_array=data(1,0)
: K/ n/ x+ ?; I$ i& c' g/ p
/ q9 w/ @( }# v. `) O3 J6 f: Wadmin_cate_lever=data(2,0)
  j5 t" c6 }  a2 f
7 s& ]% C" @3 o6 L8 Dif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
% i+ C$ }3 F7 @5 I5 d
- G+ I) L$ I, G+ j" {# p: N2 Pif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

- j9 t1 R* U& j$ i! I% _" Tif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
& {4 M% R  r. b) g* x
' }: q* y# a! `2 H% A' Lif clng(admingroupid)<>0 then

2 T( y7 q, A; F/ H6 |admin_lever_where=" and menuid in("&admin_page_lever&")"
: G# N& o0 X$ v( o" ]( M3 E5 A9 [
3 a9 v: y9 Z3 [end if

end if

end if

- ]$ s7 S, w' T8 M  Q! X1 yend sub
0 P+ j% ]( N6 Q8 V漏洞证明：
8 M- Y; S0 J; Y5 o) G( Q看看操作COOKIE的函数

public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

, I. R" G  r5 C! \end function
% f( |/ q$ S$ x3 o% v: m+ `: e
public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1
$ ^% V/ c9 t7 o9 H
2 z5 w3 z  E- R* _end sub
; W+ R0 [0 e! {2 q( r' d
prefix
* m; p; H1 m2 m  i0 C
& x5 r0 i. W9 D( z- ?'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
3 t( h+ L( `1 f" }+ U
7 s7 J$ V3 Y7 F6 d/ F( j% B+ u* @: Wdim prefix

prefix="1Jb8Ob"
; g  F3 o; F5 W. k6 k) V$ q2 I
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

- a2 p5 @3 f) k( csub out

, z3 X+ E' I: r6 Csdcms.setsession "adminid",""

* I& N! S4 z5 Y4 W! o# T2 ?4 o' A5 U. I2 \sdcms.setsession "adminname",""

9 t% a' N( [' H: V) Esdcms.setsession "admingroupid",""

1 D/ _* X- E% V: _& y( k. Nsdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
" x7 j3 _( @( ~- ~! Q
: H4 o- I! K- k- q( ?8 `( Jsdcms.setcookie "islogin",""
, ~5 w% q  G& \* g$ J2 F% s5 H* A
' n& ]$ y% T* q7 Y/ }6 o' z) Jsdcms.go "login.asp"
6 Y$ q5 ~0 R  p/ P0 h
9 C$ R" n* r/ x( Iend sub

: Q9 n  J" u0 C8 v- g. \
. U: r( q4 S/ E, {; i0 E# w8 l  a利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！