SDCMS后台绕过直接进入漏洞

admin

要描述：
8 B5 j  b+ F# y  p/ s$ u. L* j) z
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
6 P5 V, i9 V: q' j  ~7 A" J. ]
3 c' ~' |" y0 o. rsub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
) k0 Z4 h" L8 ~6 ?* Y( p
; _! o* h0 k" Kdim t0,t1,t2
4 Y0 X, Y7 P# }0 n, s( r6 |+ M
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

' ~' I6 d5 `8 U9 L3 f7 z& ?t1=sdcms.loadcookie("islogin")
# X* K  N& Z1 ~% E
t2=sdcms.loadcookie("loginkey")
3 }! o, z# L, T
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

( o. L" g/ X) N( `: H1 O8 S% C, n//

; J1 [& {# r* c+ V0 Z# t5 K6 Esdcms.go "login.asp?act=out"
1 }' m) w3 b! e& V; O2 ~2 u* j
exit sub

2 H- R9 c" t8 j1 kelse

' x2 l+ l3 J; {5 h$ Xdim data

' t4 b4 {* X; G/ wdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

sdcms.go "login.asp?act=out"

+ q# t" _; E# j$ e) u  Vexit sub

else
* _7 G) D7 h$ C3 [
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

( F" ?& j$ b) r: g5 k8 Psdcms.go "login.asp?act=out"
0 }! f% ]' C4 C
exit sub

else
, {& o9 @5 C- l& W" y
adminid=data(0,0)

% @" {( i8 P" ?# T* gadminname=data(1,0)

6 r. D8 \5 t2 qadmin_page_lever=data(5,0)

5 B5 y" N9 M1 Madmin_cate_array=data(6,0)
! l) J' U0 H) W: ?9 J
admin_cate_lever=data(7,0)
5 W/ c0 F/ @. r6 V, t% U
5 w, W! B& M2 L+ ^: lif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
( H8 Z$ E7 [3 @/ u. g. B8 M
* U3 b( }+ x+ c# \2 }if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
" m' O/ L! I2 A; _0 |" l; V
if clng(admingroupid)<>0 then

& Z0 \0 J* j  [/ a8 J: z1 Kadmin_lever_where=" and menuid in("&admin_page_lever&")"

( E2 V+ C  O  i; |1 G% X+ Send if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
, t3 F' G* Z& w# a
0 H; Y' l, r; C& vsdcms.setsession "admingroupid",data(4,0)
; D/ S# F* F# ]$ m4 H( n7 ^
5 C( m1 h* b/ O( i+ S! oend if
- R* C; e% T+ g, q
end if

end if
- o$ a; X% m+ l
9 t0 L* L/ w5 `! e7 ^+ nelse

+ l; ]8 z( a5 e8 Y( Q. Ldata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
; W" T& G  C, w- s
5 |" X- }8 {/ O. C4 tif ubound(data)<0 then
: N2 A8 R! @: P% `; `
8 U6 R% J7 k. O# t9 w* m0 B7 P- csdcms.go "login.asp?act=out"

& f- D% m/ ~# m* pexit sub

else
4 Z2 P7 m) b  @' w
; `! C# k; S/ o3 jadmin_page_lever=data(0,0)

6 O' L3 k+ ?; ~0 e- nadmin_cate_array=data(1,0)
3 V' u, m% f3 d
8 A" q) t! c) c( K6 [# J( X0 Y' Uadmin_cate_lever=data(2,0)

9 T0 y8 [  p. k, ?if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
# Q5 M; n* ^2 Z& k6 J
  Y. C6 T" o7 Y$ S  h2 _# kif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
( P9 {/ }0 V, ~. d! a
if clng(admingroupid)<>0 then
# v. `2 d; G4 x# Y+ e' Q, q
: b* o: |- z  B. v- j" n! Ladmin_lever_where=" and menuid in("&admin_page_lever&")"
6 e3 I* x/ @$ M$ ~
end if

% y7 Y+ U0 T8 x4 Oend if

" T. A0 `& v2 O/ f0 [; o9 Jend if
* ?% u+ b0 A0 a; R
end sub
1 K5 d! H& }* @4 {6 u漏洞证明：
看看操作COOKIE的函数

# B0 J& c' L4 e* t: t2 Q$ opublic function loadcookie(t0)
2 }; G5 {$ @! V- d' g
" F$ x- Y; f* f' |8 Y/ n7 wloadcookie=request.cookies(prefix&t0)
! N2 }% b8 i# z
: h1 w8 v( R4 E7 Z9 Kend function
0 K- T$ R! r( D# r% c
public sub setcookie(byval t0,byval t1)

. g4 b& t8 r9 B1 G& P1 p* j! Xresponse.cookies(prefix&t0)=t1
5 |9 r# {- I$ q+ z5 _
- W1 A0 ^5 T3 [+ N* Kend sub

prefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
% y/ O; }4 |' C/ L4 ?4 C
! w$ O; u' H! `dim prefix
) B/ \/ f, ^1 {3 W# I0 @
2 x  t# r7 N  d# r: R; aprefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
7 {3 q  G* k- j; a) d; s
' I: r" v* [8 K2 Rsub out

sdcms.setsession "adminid",""

sdcms.setsession "adminname",""
# p7 C* ?( F. {$ _
9 ?# A$ r  o% N( |sdcms.setsession "admingroupid",""

! p8 b. p; m* ], j% O/ Q- W$ Ksdcms.setcookie "adminid",""
0 A6 ~' i9 B1 @9 F5 D) ^4 i' v
# Y* a9 I. E; c) esdcms.setcookie "loginkey",""

" x# R3 m+ A; i) l0 qsdcms.setcookie "islogin",""

sdcms.go "login.asp"
: _& i3 G" O& q1 k
end sub


/ g5 H5 G, z/ q" b3 i. |5 S利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
; B* |3 X3 A* r1 y修复方案：
修改函数！