SDCMS后台绕过直接进入漏洞

admin

要描述：
' K# d7 g  t# l/ S9 ~- f9 h9 Q& e
6 U7 B. `3 |4 X& M, kSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
$ O0 m- M' f3 a详细说明：
Islogin //判断登录的方法
, G+ \* K" C& M6 W- ?( p
sub islogin()
4 {" y9 `. X4 k. u2 C
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
& S5 U9 E  S/ h) A: q
& n; U* Q/ P! Et0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

/ [4 r6 `( k. St1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
: L5 r$ r( q) Q; V0 J6 P
//
) o' C# S! S# V4 {* H
! \- C9 |7 u0 L3 E- t- W; nsdcms.go "login.asp?act=out"
$ G+ P) j5 ]9 ?% e. h4 l
exit sub
' S0 r- ^# q; k5 y
else
% `$ H7 F1 V' {! P: j/ \+ d: A6 I
dim data

# x  A! ^" `- _$ J% r+ r- Hdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
! m, z5 N: }3 v* |
if ubound(data)<0 then

sdcms.go "login.asp?act=out"

: B4 P0 b2 K- R& E, z$ I3 iexit sub
) ~  H) [- n# i2 O- _$ A4 a
else
+ ^7 {; H5 {! [1 n) m7 D  J. D
1 e6 }/ Y8 }! S7 V8 m, n3 r6 i" cif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

- E$ B1 u: h2 v" u' [9 Dsdcms.go "login.asp?act=out"

exit sub

8 C/ c! w1 S6 F% e5 a' p  qelse
$ a2 A7 j+ n* a' ?3 t8 C
adminid=data(0,0)

adminname=data(1,0)
# u1 \- k2 `; }: C
- t% q: z0 l) g' s5 x) t5 x, Vadmin_page_lever=data(5,0)
1 p+ z3 J5 a$ ^/ U
1 X9 J- |( B9 W  T; {& ^$ D" l! zadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)
+ e. ^# g. J! g7 p' u
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

5 A/ D/ W+ a& {1 V7 s, X$ Mif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
+ N1 Z/ k( e) y' J- f( `
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
& J  p, Z3 \% A$ W* Y
if clng(admingroupid)<>0 then
! z" c5 O" d" ]: _' A
admin_lever_where=" and menuid in("&admin_page_lever&")"

" x. Z( ~/ f( Send if

sdcms.setsession "adminid",adminid
% w1 U7 @. t; O: w0 G% H
sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
/ l) |! R' t' s! g! c
) {( w3 n3 Y$ x  b$ C: n" `( E' qend if

8 ?: m2 E& A( y& Fend if
4 @5 @9 C: L2 ]
end if
& J2 L, d0 @& n% l5 {7 K  w
7 i: O( U3 {; \: x% velse

8 G" y2 f  X4 R1 Ndata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
9 n/ |$ L' I) p4 G! v: K0 p7 B
if ubound(data)<0 then

+ F- \% |* R6 a+ E7 G7 Dsdcms.go "login.asp?act=out"
- J, d9 l5 \9 U7 \) s& G
# A. s+ X/ ~! a1 O8 p* T0 {exit sub
$ ^/ t! ?  ^2 }: P8 v1 R  d) D" \
) s/ n6 R& \* S# s8 ]else
2 @( z) p7 H1 x7 Q* O5 n  P0 d
$ c' x0 k3 W/ r7 U7 tadmin_page_lever=data(0,0)
6 n" d7 g/ E2 e& y0 w9 Z4 E
admin_cate_array=data(1,0)
! r, Y3 Z; i- J7 V% G8 d
, Z1 \# o; r5 E! q8 R- Qadmin_cate_lever=data(2,0)
$ O2 Q3 N9 ]. A' r/ `
# C, R# R; p8 A4 m# y; Iif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
1 x  X2 O6 `- E; W* |5 Y
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
! ]+ b6 S$ c$ d' w. P  x( ?; C- S
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
" X1 O4 q, @" X, p( g
if clng(admingroupid)<>0 then
; B- w; L- u  w/ e! i; ^
5 [3 T! B2 G/ x- X3 t. r5 Vadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if
' L3 w/ Y! ]9 ~
: Q7 ]( m  n4 _end if

% L& ]2 t8 b( d5 ]$ Z+ F- send if
' |: {9 |+ Y5 F$ X) }0 l2 T
: @/ ~2 j4 _  g  Z- h$ ~end sub
2 e( t. ^# V5 W漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)

5 p- d& R5 j) n  L) i0 Tloadcookie=request.cookies(prefix&t0)

" `' Y/ I* t- ?end function

% v7 M' y$ L* D9 w8 x$ x  K9 l. xpublic sub setcookie(byval t0,byval t1)
# x; h7 H  z. ^. m' Z0 [
3 [/ C' W# Q# r- n1 @6 c: Bresponse.cookies(prefix&t0)=t1

end sub

prefix

% D  x) E, [- [' Q'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
9 ?# A/ V6 Z* T. \$ W: V% H2 g
dim prefix
% o- c) n3 K: d% ?* ^9 |
, E+ [% Z3 k+ q6 w& y. B4 nprefix="1Jb8Ob"
8 B  z. H& q. T+ H! z
9 M- ]& G1 ~( o) D9 k'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
* A" I1 o; c3 H, b. @3 T
sub out

5 h, }& s( m) f% }5 usdcms.setsession "adminid",""

# h( j9 H0 o* Z4 Q; ]! Ksdcms.setsession "adminname",""
* |6 J" B. p+ x  T, O0 b$ C5 h
sdcms.setsession "admingroupid",""

! e. y8 ^' Z8 D. k! P; ~sdcms.setcookie "adminid",""

7 l; }8 Y: u6 o( @( {  ksdcms.setcookie "loginkey",""
3 H; a+ J: {+ s8 v& m% ]; K# L
sdcms.setcookie "islogin",""
1 I0 o9 {; l1 e1 m. {0 h  x
sdcms.go "login.asp"
1 v5 y3 {* x+ K/ z
. P) U( Q! m8 Z3 L+ J5 Cend sub
- ^$ x! z3 k- R) g+ q3 E
5 m/ N9 x* L( K$ E; l1 b* H
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！
; y' p# `4 K' C$ X