SDCMS后台绕过直接进入漏洞

admin

要描述：
) i4 ]8 ]# p4 Z
" L$ t% z$ t" d- X: d% a( t! ^SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
. {4 y$ l1 w1 h: `! P详细说明：
Islogin //判断登录的方法

+ n% L6 f  d. [" {+ z" g; D2 n- Bsub islogin()
" l$ Y4 j' e( b! U/ ]
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
2 J7 x2 p, [  A* b! y! [3 x8 ?
dim t0,t1,t2
8 h) m- ^+ s# M! X2 g
  f; p7 Y% d) ^6 }1 c, wt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

* y# ~# j; s% Rt1=sdcms.loadcookie("islogin")

# Z/ z# y4 A' d0 ?3 ]! t' _5 Ct2=sdcms.loadcookie("loginkey")
' c6 q0 {* C# N4 s! i$ r9 D& p
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//
$ l" ?" H- {- R2 J# }
sdcms.go "login.asp?act=out"
: m. o7 O# {% O$ v. k1 T
; M4 w  W. z' z( T6 G3 P3 Lexit sub

) V4 ?9 w% A3 Z. J! S) ielse

dim data
9 p9 ]% j5 f+ W% w# V+ \" Y) V
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

4 g0 f3 e3 ~8 b0 P; Tsdcms.go "login.asp?act=out"
$ o1 X2 ?" I0 f4 l$ O
exit sub

6 t' e' z" E! L( Pelse
; T' g; v1 ^) \! G! _
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
& F! F  k: k9 f1 R9 n. H0 g8 X
sdcms.go "login.asp?act=out"

. B$ O1 A$ [; C1 aexit sub

6 q4 e6 p# _$ a3 \9 belse

$ ?4 _. K% d5 |1 Y  b1 M  m3 s; h& gadminid=data(0,0)
1 n$ U1 W. K5 e/ u$ X, G# D
adminname=data(1,0)

admin_page_lever=data(5,0)
3 n  ^, {4 g* m) p6 t% k3 u% f: i
admin_cate_array=data(6,0)

0 P  c( p0 I* ]+ f7 ]; d9 b% b8 madmin_cate_lever=data(7,0)
7 z8 U  |2 w2 \  |
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
; \8 A: F4 z/ z* \+ j' p2 f
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

% x' A5 u7 D. P6 Y% T; u, Vif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
  q+ \& M- j7 z7 b/ M+ a# |$ `
admin_lever_where=" and menuid in("&admin_page_lever&")"
: u" M+ S8 v# o. r- N$ j6 D
end if
9 g6 U. v  k, F4 ~: T: F. j
& `/ X, B) Z" ?sdcms.setsession "adminid",adminid
+ _* [* X% |/ K5 j5 \9 I! o
' c( G% \) B/ B. f6 f7 F8 M) z' ssdcms.setsession "adminname",adminname
* v$ w( m! N: l# x
sdcms.setsession "admingroupid",data(4,0)
6 x0 h5 \1 ?. B- ^5 L
3 Y( I6 O+ g2 Z+ h9 O- _6 s6 ?end if

end if

end if
# v. G2 k+ A. P2 P( {5 `
else
) R: M, K% P1 t9 w% N6 c) {  t7 J
/ C2 @! F4 g% f; d% R) ?$ l' ^  Jdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
8 X# ]: F* I+ G; H( }
if ubound(data)<0 then
* W# I% ?3 _5 u3 K2 v0 d% U+ n
sdcms.go "login.asp?act=out"

& [6 z+ X: R0 z3 D; _exit sub

5 l8 J7 r/ w" a' S( J7 Zelse
5 ^! ~) G4 O8 m- L1 S5 S
" ^, r  _$ N! h( m+ Padmin_page_lever=data(0,0)

admin_cate_array=data(1,0)

/ k- S3 n+ j. H& e$ hadmin_cate_lever=data(2,0)
) R. _  P& v9 \3 j
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
* [/ }* Q4 S6 ?, k  f
# h  \9 z8 r& [8 K: K3 Bif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
2 O! O8 B9 u( ]7 ~
3 \- ?' i: e6 Z/ J$ vif clng(admingroupid)<>0 then
7 l% s3 U' S; c6 u- t
admin_lever_where=" and menuid in("&admin_page_lever&")"

. a3 F& {, F( F5 j0 zend if
9 T( d- n) G+ A; ^' D. i9 P
! t/ G+ p" x1 l  t& X) |, a! F$ _4 uend if
! T2 Q+ P& c+ t8 l7 O" m
end if
6 \) Q& [& F6 Q: `
end sub
漏洞证明：
: E5 D# Q# v" p9 P! w- d: [看看操作COOKIE的函数

& @5 i# Y, `8 D! Q+ Lpublic function loadcookie(t0)
" p% d' P: S: r
loadcookie=request.cookies(prefix&t0)
3 W/ k2 O9 k$ x6 Z* r/ ]: X  \
end function

/ j" M1 z8 i  `3 X$ Zpublic sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1

( |( D  c& T7 v8 eend sub
) N7 t5 W' v9 I# N  P- h
& ?, i4 A# x) E' ], S* kprefix
# [) y. W$ E6 r" N' B
/ V- N3 p% N$ L1 F'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
* Y' B4 t8 i* c1 Z+ j
8 T& r+ D  J. U/ q6 ?dim prefix
$ V' b+ E" x- s0 P; h5 Z  j+ \
prefix="1Jb8Ob"
4 e3 L7 A: w1 m5 M4 y3 ]) {+ X. b
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
9 p+ B3 a( F) r" N( u
sub out
( G  v' h- }3 |3 R
% A+ J1 Q3 {1 j8 Ksdcms.setsession "adminid",""

sdcms.setsession "adminname",""

0 e5 Y; C& ?+ v3 asdcms.setsession "admingroupid",""
- k) e+ J8 Y8 u3 y3 @- e, q
! n# z: w, ]$ {' }. B5 X+ `sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
8 j; L9 }5 B; N7 w+ M! p
sdcms.setcookie "islogin",""
! f- I. Z  X$ A# O) ^3 C
0 ]$ b. E8 k/ i( a3 ]( Lsdcms.go "login.asp"

6 ~1 J8 h1 w* ~$ _end sub

  T. y5 J: N2 j# w) B, X; G
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
) k" r5 l2 P+ D9 H6 k- U: O) K修复方案：
修改函数！