SDCMS后台绕过直接进入漏洞

admin

要描述：

) C; d7 f7 l' T2 bSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
4 t# C8 {7 L3 t3 _
sub islogin()

( Y0 t% W3 z! Q  N0 aif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
# g) [+ o3 y1 |4 b0 a1 d, T% m2 B! N
dim t0,t1,t2
$ S8 o  e( J/ O1 v' J
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
4 a0 O* ?3 Z3 s5 z
% j# ~+ S( c/ b7 G2 jt1=sdcms.loadcookie("islogin")

$ _- i0 g" a" N! t0 _. ~t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
% E2 Z+ r6 |! f- ?6 N3 c
0 F+ b" j  D6 h3 _: F) A; f# U//

sdcms.go "login.asp?act=out"

exit sub

9 `. X; z; V  j6 K7 r# belse
' I' r; X0 X5 S
dim data

7 |! H2 {# c! ddata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
* L# c* G- K6 Z* V
if ubound(data)<0 then
5 `. e) E; ^& G: }" L4 V$ u
sdcms.go "login.asp?act=out"

0 _- U0 e3 \* g3 i2 E# R- Y9 Dexit sub
' F. A7 O9 U! X$ ]+ y9 Z
0 j/ p' S+ ^7 l) \else
5 y+ P6 o  K: Q; u5 I; d! G+ p
# p0 [% [8 y  s7 z1 tif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

; b; L+ D* j- l* Ssdcms.go "login.asp?act=out"

; ?* f3 l1 \2 rexit sub

else

adminid=data(0,0)

adminname=data(1,0)
: E& J3 {! |6 V; D' _# j& ^( i
admin_page_lever=data(5,0)

admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

; P7 U5 ?. w; J. x' mif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
& s8 u& T/ w" [$ E) K& m
- o. w' h! e" f6 L  y) C9 i6 Xif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
! L7 R5 @% {( [4 o% H
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
- o9 _" Z* L+ z% m2 w
+ R7 v0 w9 z! R& D3 p5 x- Oif clng(admingroupid)<>0 then
' b, o% c' G4 U- L) W: U. A
admin_lever_where=" and menuid in("&admin_page_lever&")"
! u. j% m5 c3 U7 G  P4 I( R: t
end if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
. C+ X; H! Y$ d
3 G& d4 h9 z) [# T- m! I& f3 Asdcms.setsession "admingroupid",data(4,0)
3 B2 |# A9 g: q7 L4 j/ F* X6 L
; I3 U) |* _$ S% vend if
6 B! E( ]7 j$ c- D. r
end if

7 Q% ^* k: |( D4 u* {$ [0 |- Jend if
$ ~8 [  n( C! l+ U/ A
( ?1 w" z. A; ^9 O7 e- ^else

: |! p( C6 [4 w% ]data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
4 x- S" |; r. D+ ]& O
: M3 V, d& }; v1 w, ^" Oif ubound(data)<0 then
* M9 }" A$ c+ n8 a
& E6 L$ ]* n, Q( ?7 D! H: Csdcms.go "login.asp?act=out"
* |, S9 }( _  {% W$ {5 X, ~/ y
8 x1 B! P+ F2 ~1 P6 dexit sub
- \: V) H; I6 L+ K. p, V; f& U% p
else

admin_page_lever=data(0,0)

$ B' ~* e# b  p2 O4 h5 Kadmin_cate_array=data(1,0)
5 U2 i" ]; O& E- ?# E" E  O
( m+ |) L3 c9 F+ Y! Zadmin_cate_lever=data(2,0)
! }& o% X9 @) [$ V8 O
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

$ b- X$ z# ~$ m) ?( e! u% o) gif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

" U: A" V. W. v. t2 N2 Lif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
' w* ]+ n/ J: x, c+ C$ m2 q# b
9 h. o* b. l& {; [. Aend if
5 w% Z6 _% Z4 E. h& W7 ]  \8 v
end if
$ a, ?$ F, }( q
end sub
漏洞证明：
3 m( l( D: s! [看看操作COOKIE的函数
& ~+ ^9 M9 I/ `: J$ q: @5 c/ \0 q
2 K% ?) b- m) o6 @' Apublic function loadcookie(t0)
& Q; Q' P) y5 J$ o+ w
$ i  S  [7 Q% b5 B$ Qloadcookie=request.cookies(prefix&t0)
+ K: w: Z  S  C* n  v* F& n$ e
end function

. ?! t& Y7 w( J. C) N' Xpublic sub setcookie(byval t0,byval t1)
( v: B( T6 g, g( q% H9 h% z
8 U' _" r! S- O3 T; S) N3 hresponse.cookies(prefix&t0)=t1

: L6 n# N" a2 C. Zend sub
+ I  L7 M# i; j0 S
0 ^# A  I9 q* ~6 @' ?7 ~. k4 E0 K7 b. Uprefix

3 m, s( Q: X  k& n'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
* x  h% N4 l. P0 H2 J) r
dim prefix
. s' t: Z6 e7 g, [! ~
3 @9 ]2 ^' Q. o+ `9 Dprefix="1Jb8Ob"

- c9 v, v6 X$ e'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
( P4 G' p1 s: r8 a0 ]" ~
7 V  b6 q- k4 m$ Wsub out

sdcms.setsession "adminid",""

* k* t  |1 H0 c, S0 ~sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

9 v! k% j1 f( K- c- Wsdcms.setcookie "adminid",""

. B5 r! L" l3 u8 v8 A! ~sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

sdcms.go "login.asp"
3 p/ a8 t* k) ~5 a; D- F8 L/ a
end sub

; |, ]/ S; D, N; r2 S  |8 [! z+ f3 W) T
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
7 c3 T* v9 j5 h  E5 p7 G' T& X修复方案：
5 O! V/ t8 j) T+ n: r修改函数！