SDCMS后台绕过直接进入漏洞

admin

要描述：
, ^- K* h7 j, v1 `3 K& _
) q" x0 v& p( b2 G( ~SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
  ~* B; d* u/ t, Y: |详细说明：
Islogin //判断登录的方法
6 t) n! x; g& p% |5 q' |! m# H
sub islogin()

3 b6 }) G" ?5 f1 x1 L) o6 uif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
3 v! V1 M3 R9 M
dim t0,t1,t2
+ z5 v! ^/ r# X4 \
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

& C$ ^( X9 l2 Y, L( `( `t1=sdcms.loadcookie("islogin")

. ~9 V- e" j0 R) jt2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
1 x4 t( C; H0 ?% _1 U2 T
! |# L0 S/ v/ e( M9 _( j//

sdcms.go "login.asp?act=out"
+ ]. \9 Y- l4 i4 b' S6 l
2 `6 S/ V3 k% @$ B: e7 V( }6 sexit sub
4 @+ e$ S* E0 ]5 z6 t
6 A& v6 l5 b1 q3 Z3 Aelse
* n" L& w& E$ b5 d. p
dim data
1 y+ o7 Y0 h3 Y9 d; i6 a
! U5 O' C6 U2 e" P7 O# E9 sdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
' J, C4 B; P! @( W7 y
if ubound(data)<0 then
0 y: u8 o9 V! }% u
sdcms.go "login.asp?act=out"

exit sub

else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
) }: z" o( h# J+ \% N
exit sub
% g( P' \, ]0 y" c2 P
else

. u) `9 ^+ q9 M8 W" Qadminid=data(0,0)
+ x4 k6 c$ _; W7 C: a/ T' `9 v
% X4 ]9 @4 {, _6 v% {, u0 ?adminname=data(1,0)

admin_page_lever=data(5,0)
# T# ?- h. p& C- O$ _$ I" S
$ c8 f+ c1 U  X, gadmin_cate_array=data(6,0)
8 N1 @1 e* r5 A
admin_cate_lever=data(7,0)
5 u3 n# |7 L( y+ X& p1 M6 b9 W
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
& b6 P4 @5 y: X: W: A) ^
1 {) k7 V+ G4 q& Y7 k* ^  _if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

" V4 M, p6 O- D/ xadmin_lever_where=" and menuid in("&admin_page_lever&")"
0 H$ J3 o1 C! j5 h( P4 [
end if

sdcms.setsession "adminid",adminid
% s5 k; W  h7 i' B
& J& G3 r) V  f, t( R- n0 Msdcms.setsession "adminname",adminname

; O" u" X  I. L3 ksdcms.setsession "admingroupid",data(4,0)

6 [  P# v3 |* s/ v- M1 o1 Mend if
9 d5 ~9 |, l$ I7 U6 Z) J) ^' A
* f5 E- n  ~# z4 Z7 ?end if

5 n% B( B+ E7 ~* o1 d0 rend if
4 ^( p3 h9 w. B$ ?
, h. C8 W7 _7 d- Z) |: welse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
( M8 Q2 J7 c" v
if ubound(data)<0 then

2 M; j6 f# y0 t2 m* z: J3 l$ g: fsdcms.go "login.asp?act=out"
1 E6 {3 C' j* x0 x- u
exit sub
, q- @9 k7 b, s1 X# @& Y
else

admin_page_lever=data(0,0)
: @! M! K- U! S! h
0 y, c# d6 F: o7 v! I9 z  {3 }admin_cate_array=data(1,0)
' m" r" y6 X1 [& m! Y+ F
. z# @/ w7 K; ?  t; `, f) Madmin_cate_lever=data(2,0)
, }* d. ?9 v( z& S# x  S
% u! z2 {- i$ m8 P; Jif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 E% ~% [/ F/ i
* J# k' y8 {6 J! {! _if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

7 \* a! u$ _) _if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
: V* b- P- T% _& O/ \
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
) X* Y( ^  j( ~! S9 A2 T5 v6 D
6 e1 B: u: `- V6 @  p6 T: Bend if

) D. W2 T) B5 F/ U7 Kend if
. I- ^, G% I2 f" o' c7 T
end sub
5 z6 R, E" N. ]$ r. {5 u+ J漏洞证明：
% z) Z( @+ n! {; R  o# R看看操作COOKIE的函数
/ _2 S) Y6 y) V( {( I' I
2 L! ^7 C# R& R5 }3 m$ i" f# spublic function loadcookie(t0)
* |; @) A. Y9 H7 G+ g, b
6 c2 b0 }6 V+ ?( X" o' Oloadcookie=request.cookies(prefix&t0)
; E( N4 W: k/ a# K. ^
* b0 s/ j# S1 w  O6 @5 Hend function

public sub setcookie(byval t0,byval t1)

7 f) h! r+ \0 [8 `3 ]response.cookies(prefix&t0)=t1

end sub

( P# z3 F4 g; q$ F) G0 D* O, rprefix
2 h( ]6 Z; @; Q2 u& z
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
' K2 u  P! q& V. K+ c& e$ `7 H
dim prefix
" \# D  Q2 Z& \/ H. |$ C1 |
prefix="1Jb8Ob"
2 r* {- D' r! R8 Z4 Q: E" Z
) M' C; |" J, ^/ M) M& p'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

7 q0 `" i) O, I9 @( M$ I- Jsub out

% S, R5 p, x% h9 f! C! wsdcms.setsession "adminid",""
+ I  R6 g5 Z  Y+ v6 x
. o0 `7 \- g* csdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""
* m( m; y2 a) _! E! T( X
- R& b/ d2 x- ^8 `sdcms.setcookie "loginkey",""
. G! n" i! R9 V* J
sdcms.setcookie "islogin",""

0 \5 r# a) q5 B  asdcms.go "login.asp"

end sub
  ~2 h4 n+ w0 ?0 R3 k9 L7 x
9 G. s4 J2 b! [$ U+ O$ b
' u2 ^- u' l4 o5 g利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！