SDCMS后台绕过直接进入漏洞

admin

要描述：
3 m% T9 t5 ^  h) t! @4 z0 R
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
6 T( i# j( ]; o, Q: QIslogin //判断登录的方法
; h% F3 F0 p; ?( E) S9 y
sub islogin()
: D- S7 c2 ?5 S7 F" t4 a+ T
4 e. j( p9 e* L" i9 ~5 A4 {if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

* h/ m0 w  W& u. U5 {+ Gt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
5 [6 C% @$ W( B9 B+ H) c; A
t1=sdcms.loadcookie("islogin")
" K  J. @$ P- Q2 V9 W  k/ v
t2=sdcms.loadcookie("loginkey")

0 F. \8 B# g6 ^8 Zif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
/ X9 N" n4 {  M6 z
  x7 Z+ Q% X. A: q//
9 i- b4 ]+ C, m1 e
- s2 r' }! o5 Ysdcms.go "login.asp?act=out"

exit sub

else

4 L. L7 T. x& Xdim data

3 Z' a3 M' C* f& _7 c& cdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

sdcms.go "login.asp?act=out"
4 J; z1 ?# D' R6 ^
5 h6 O' G, n0 J0 k% yexit sub
0 \% L' t4 x# O3 {, {7 r' z
. Y, w. y. D7 Z; Uelse
5 p  _% \" H) O1 M3 F3 h( x3 p! n
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
: T/ W2 X- B7 v5 H1 t
sdcms.go "login.asp?act=out"
  {  |) u/ K) n0 J
6 y# B% Y+ }  N  e2 [/ dexit sub

$ ~6 r5 y6 E; d; oelse
* `3 {" D7 i+ [+ H' T0 O. N6 B
- ~  j! a4 q2 |5 s7 Jadminid=data(0,0)

adminname=data(1,0)

6 i  N0 q, M. T6 ]- V! vadmin_page_lever=data(5,0)
6 K4 Y' o5 E# x  _% {3 H
/ z% K- ]. {" S8 \admin_cate_array=data(6,0)
5 p4 b  z: T+ Q% k. Y% C" x- i
admin_cate_lever=data(7,0)
, |  B0 G7 U1 a! V: b9 `
) w7 A3 R5 N- f( Qif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

% X3 O# y# E# L; vif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

/ o" D1 J5 Y! ^% `  xadmin_lever_where=" and menuid in("&admin_page_lever&")"
, w4 @: l: V- \$ W5 x/ g
' p; Y7 o+ T; H( Q$ ^5 `end if

5 a- d  T* S9 ~  ~# c6 i& }sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
  O: E  n. a, B( T" W5 |
) I) j$ i* y) }9 Xend if
% b- K0 t) h% [2 ?3 U/ l
$ m7 \; {6 E! V. W7 vend if
9 N1 k# t, [  t: |; Q
% c; H. r# j, ^2 ?0 l! Yend if
; A) _7 V. R  I$ T5 p$ w
else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

3 N- G6 Z5 D  [1 R1 M8 Isdcms.go "login.asp?act=out"

8 J- `! D. U7 X5 [* texit sub

% U4 w) r: Z9 ]else

' n$ |8 M0 e% r4 F9 b" {, J2 wadmin_page_lever=data(0,0)

  e2 i9 g. C. ~3 ^  f+ iadmin_cate_array=data(1,0)
0 d& X& i$ |& }: h5 C
admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

' ~9 U1 t9 D3 X/ Q7 z6 @if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
8 [. w/ ^! x' [. t$ ]$ a& p& ?  {5 b
- b1 Y: l7 J% d9 X3 o. A1 Uif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
& `. `% c2 t4 m$ W6 t3 q5 M" ?
admin_lever_where=" and menuid in("&admin_page_lever&")"
' ~- K1 n1 J: a4 C9 ]
# |0 s5 S9 {2 `) o& r" j9 |6 m7 Tend if

2 A2 |" ^/ [# p0 L7 g0 i) nend if

% |* B# O1 H( cend if

; h! h. |4 M4 J+ G' T, Eend sub
% i9 ]. t1 o/ b7 |% I( x8 C漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)
+ o8 A/ j& H3 q- y2 \
4 G4 m9 B. S5 P7 X2 Tloadcookie=request.cookies(prefix&t0)
7 J  h. q, f1 W
; U8 j: U6 S9 r. Tend function
5 i  V# n! S. v
public sub setcookie(byval t0,byval t1)
7 r5 A" i. G1 U' G' D5 R+ M) R3 x
response.cookies(prefix&t0)=t1
8 [- q) u/ s! V
3 P" C6 y4 G2 J0 J. a0 \9 f; eend sub

) d4 G5 H5 ?$ i& G# Q  @3 cprefix
& V! z7 Z2 l( s; z3 I1 U, Z
, {9 ~3 R. G2 K+ n" y" g& \1 e'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

9 q$ \' L8 K+ @  @( x7 z; n3 pdim prefix
( L/ Z( K& L6 i
prefix="1Jb8Ob"
6 Y; F( P7 `9 m1 X: ^5 A
2 w! _$ Z9 S& r$ E7 v* G'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
0 d' u7 [6 d0 a( h* l  V/ m, n
sub out

8 Q/ o0 P( v- k; Psdcms.setsession "adminid",""
& {: E' C0 r" [; V
sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
- K6 }* X7 P8 f- p2 m' p! e
sdcms.setcookie "adminid",""

" G5 Q# T& {1 D3 j; t9 b+ i; Bsdcms.setcookie "loginkey",""
9 o& }# K% g" w1 n/ y
sdcms.setcookie "islogin",""
: R. ?1 s5 i7 l5 C
% G: t8 R& f- S1 X1 @sdcms.go "login.asp"
/ a. J% m. L) i& W$ V' E; N
% _+ [" T* X: q7 v0 a* x; v/ kend sub
+ r+ A& y  P; Y3 G
$ ]$ y! F" U; s% y6 `) O
8 Q: v& z8 H8 d: B7 Y/ u' r利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
7 Y& n, }# D: g3 V/ W; j修复方案：
2 ~1 N+ w8 s" `3 o+ I* l& L# k0 T修改函数！