SDCMS后台绕过直接进入漏洞

admin

要描述：
& b4 Y7 X5 v( c
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
: [+ r: I) @) oIslogin //判断登录的方法
2 `$ L3 u8 i" \. U
, Q3 _) q% ~+ f- ?# Hsub islogin()
; |4 g( [2 |% @; R- K* U
6 T( E" a5 F) Wif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
5 w) t& X/ h7 B- i2 _+ a3 N
& T2 F- Q$ p4 l" F$ w' Xdim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
) x8 A- {# s9 t: P) X/ P. S5 M
8 _$ g5 d; C7 T: qt1=sdcms.loadcookie("islogin")
' R8 k/ O, Y; k& A
. E" @( ]; B/ v0 g; `( ~0 |t2=sdcms.loadcookie("loginkey")

: F" l# D* w, L3 A1 vif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
" n& m$ [) j; D; w& k+ a
//

' `9 L" [5 Y3 x' \5 A5 e. U& k% }sdcms.go "login.asp?act=out"

exit sub

else

2 k/ V3 b+ F  B2 _dim data
, Z, J0 P$ ?: A' ]" q
$ r, R" G1 K4 h  p) Rdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

+ h4 }; w3 q, X. n9 i, @4 i' Nsdcms.go "login.asp?act=out"
! i# O4 Y8 M- N* K
exit sub
3 _; E0 b* N  b, D0 q4 A
else

! Q2 y7 A3 T4 g; O9 e  jif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
9 D" b- {2 K& O4 [
4 J: E3 E9 j; P6 s( z' m1 Asdcms.go "login.asp?act=out"
8 H& m1 Y; C# {3 v
exit sub

; ~) u$ \0 ]/ P1 o/ j# x/ g) ?else
6 D6 I7 ~# U2 K3 e
' L2 R; w) \  W4 Z. H' [adminid=data(0,0)

5 w9 o- @$ A# W2 F: e, M+ G: ^1 Madminname=data(1,0)
7 C+ p6 b/ }: ~- A$ G
" C3 }+ s4 b7 B; y6 _admin_page_lever=data(5,0)
( h& e7 ^# ~( ?2 U
$ ^/ G) N4 K. `+ X+ ]admin_cate_array=data(6,0)
/ f; i" ^, Y1 y3 r2 D
admin_cate_lever=data(7,0)
$ m, s5 B" C" l3 P4 J
* Y* ~4 J0 N- N; g8 Uif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

5 r- F: i" C/ tend if
& J  H7 _8 n2 R, R* g- L4 G4 S$ [% l- C
sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
% O! `: ?9 Y( ]7 D5 i- p
" J; Q# k  L( ^3 V: k; eend if
1 I+ K: ]) k" _& u, O
end if
: g3 `2 l" P, Q5 Y9 Y7 l0 c2 I# o
end if

else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
4 B, j' R* W! D4 C$ }9 d, z" X! @
6 U3 {* z( |  T8 Kif ubound(data)<0 then

9 P5 \1 j% U+ M) ~& N* p4 Ysdcms.go "login.asp?act=out"

; O2 j9 s6 r4 `3 E* H2 _8 d7 zexit sub
4 n/ W9 }6 P# N9 |. `9 O
  v6 j  J7 O+ Zelse
& P' n+ u  {+ U! a) R! p6 [
* j9 W3 w" D- Y; Nadmin_page_lever=data(0,0)
7 e: y9 S# o( T* K! @! x
5 `: g) h$ h' N/ fadmin_cate_array=data(1,0)

8 D6 Q' p+ f5 D# K- wadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

& K& W: S! d- ~if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
  }6 Z0 a! R+ H2 H
if clng(admingroupid)<>0 then
3 S8 V* P9 W* O
4 k) v7 u9 K5 B% D7 eadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if
8 Q# W, [9 O, h- c; L
end if
- G! `# r. ~( P) o' @, G7 ]* c
end if
" U% ^, n, }7 c# x! l. H" d! I- S
end sub
) M4 a  n) o3 a# y0 s( U漏洞证明：
' l3 ~6 F3 j1 u5 l5 b: Y看看操作COOKIE的函数
  }0 Q  W2 e  y: v
8 \3 Z/ v4 n1 y+ i9 s& ^public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
" V: [6 p2 s; B8 B
end function

) x' {: ]4 E0 m/ _' Rpublic sub setcookie(byval t0,byval t1)
" _/ `. f( j4 [+ p3 w
% t  @( a' y' D- Y0 m) M0 e- N/ xresponse.cookies(prefix&t0)=t1

6 ~5 d( w( h6 J* \( [end sub

prefix
3 K& u; t7 |; K6 U0 L3 Y. O7 `
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
& Z, R! y& j0 T. x3 ]) {6 ?
/ S9 l* S* {& l) h7 ^9 ?dim prefix

prefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out

1 p  Y" h( b" Z9 osdcms.setsession "adminid",""

sdcms.setsession "adminname",""
5 s) j2 k3 m+ {9 P. P: L- L. Q& a( Y
6 \/ x( ~* v+ ?sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

7 n- r- }  F1 xsdcms.setcookie "loginkey",""
5 f% I4 \1 ~" {# N# t8 R. A
sdcms.setcookie "islogin",""

sdcms.go "login.asp"

end sub


2 G( M9 [8 A3 S7 f& f" o6 r利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！