SDCMS后台绕过直接进入漏洞

admin

要描述：
& z4 t' G) {* \3 f" S, H# _
: Z( }8 N7 S7 V" _/ PSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
! u7 o' e4 D1 i  B+ G( q: o- [
sub islogin()
4 e4 N3 D+ E: ^- @" Y
# X' O4 w, x. pif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

, ]+ N( d$ l0 D5 Dt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
; @9 d8 [& h5 g" F/ W
t1=sdcms.loadcookie("islogin")

& `5 e1 ~; W8 d4 [+ A+ St2=sdcms.loadcookie("loginkey")

( ^: N) _) J  B$ Yif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
7 P  }* `. s+ m8 N1 \  P2 \
0 j. h) |/ |5 L7 \5 ]1 z8 P//
% g$ `  D$ p, T! E8 T& \
sdcms.go "login.asp?act=out"
, w* _+ |% |; q2 M9 M0 @
exit sub
- G7 o& f+ \! C7 [5 k7 a1 X" ]
5 U* p6 a& o8 `; J$ a2 welse

( Q2 O0 o  k& n7 f" ], xdim data
% p; J: y% e% ]% ~% X
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
+ h6 \; T" }, ?
if ubound(data)<0 then

sdcms.go "login.asp?act=out"
* g- @( G7 o! A+ Q' l- w2 q- k# C
/ E! [$ V+ G1 F8 {exit sub
% I% k# G; x6 T
else
/ A, {' \" E9 W# ^$ v
: j& r- @$ p& T3 d$ Wif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
; d1 e: B, ?6 t, k4 D! L4 Y" \
% J) ]: M6 p1 h2 g7 j6 i7 {+ Kexit sub

else

; [1 e: J9 S# Y+ {( Gadminid=data(0,0)

adminname=data(1,0)

- P1 q% B6 R% C$ eadmin_page_lever=data(5,0)

! m' J( A6 T3 }; m3 [# fadmin_cate_array=data(6,0)

5 _. w& g, E3 t- A( Q- Cadmin_cate_lever=data(7,0)
2 _% f. _5 _: g) V
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
4 n1 ^# n( {* l% U
/ V6 q9 U. ^# K) b. q/ A# Q0 u, Fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ x, `) S5 l9 J) X/ G  ]! L8 P
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
' \) u# y' T  }* Z7 E6 c
' b4 H4 a, ]* D# \. @1 aif clng(admingroupid)<>0 then
5 y; ^0 |2 Z& S. ~* w% I- v: Q
% f- E. ?; e$ t  zadmin_lever_where=" and menuid in("&admin_page_lever&")"
1 B! N+ |( R5 `' U1 E* p2 i, }
end if

* @- e6 i  A' ^4 `, Hsdcms.setsession "adminid",adminid
! Q! z% J; D# i7 i) _3 ]6 Y& P! ]
sdcms.setsession "adminname",adminname
" K( n' W* D% i* H
sdcms.setsession "admingroupid",data(4,0)

end if
* x) U) i2 m* V2 [8 `7 D1 S2 q
end if
3 S" c7 \' |/ {# b, ~" D! R. Q2 [0 h
end if

else
' W0 W. H4 q% X9 O1 V% E. }: h
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
  q3 |, e2 }8 U; e. i
9 C& i( p% f" f' \! M0 F( Aif ubound(data)<0 then

sdcms.go "login.asp?act=out"
% c3 R- |0 R2 [7 q+ z, g' F/ {' r
exit sub

. T, t+ F5 A# felse

admin_page_lever=data(0,0)

, V5 g! A, m% `8 x! e# Eadmin_cate_array=data(1,0)
4 }8 M$ n( n7 a/ f3 @7 j
! k2 k- y5 v4 t2 ]( w0 x1 Gadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
. W3 \& p! {5 b$ I
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
; s+ H- p* Y- b, \% i
) ~" _* o8 j" H6 q2 eadmin_lever_where=" and menuid in("&admin_page_lever&")"

. B6 [# I* {. c, Eend if

end if
) f6 D2 j4 `) M& O1 y$ P
, h6 O" @) ]) i+ }7 r6 F! Qend if

1 T$ X) {7 U" ^$ V  u( y* Zend sub
  U5 m8 A6 A6 r! W2 E  T漏洞证明：
! O) Q8 ?- Q+ s" P4 _看看操作COOKIE的函数
+ ?+ G( ^4 e& q( a' O
' U2 y) ^8 x  n% V, b  Wpublic function loadcookie(t0)

, [; ]$ `" V9 D1 t( I. u; ]" l6 H2 R4 Xloadcookie=request.cookies(prefix&t0)

0 x* \; y  O& u, q% `( D/ ?end function

0 e* Q, }4 w' d  n& [4 vpublic sub setcookie(byval t0,byval t1)

( {4 A$ o/ d3 e  i0 O! Q! eresponse.cookies(prefix&t0)=t1
: Q9 e/ v0 ~4 b# q6 {% U
end sub

# l$ v3 |: k0 e4 eprefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
' P+ I, Z! ^: X4 e
dim prefix

prefix="1Jb8Ob"
% p2 D& `* G0 T+ V. |7 w
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
3 z" B: ^) t: \4 D
sdcms.setsession "adminid",""
8 g: c/ M9 z5 k+ g" p  C; n% h: A
8 v3 K/ U  Y2 E" S+ Rsdcms.setsession "adminname",""
! Q/ o6 ?5 v4 D
sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
" L: @! ]( V1 K, @. a
" A/ Q! A  k" f- b( b7 ?) jsdcms.setcookie "islogin",""

; Q  m+ q  l. b* Bsdcms.go "login.asp"

end sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
" g, u5 @7 I8 Y( E0 \修复方案：
修改函数！
8 m* [$ Z( p" S' c3 Y