SDCMS后台绕过直接进入漏洞

admin

要描述：
; P. i5 k' Z6 b4 R) @& y! Q" T9 s8 _
( m, K# {  W" d  OSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
3 d' v) X( b' YIslogin //判断登录的方法

sub islogin()
, I0 ?" x7 t+ a" D9 f4 B
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
/ ?/ b1 \6 o/ ~' y
# P4 P3 ^6 ?; s" Y& \+ p" u. ^6 k' Udim t0,t1,t2
0 o% h5 u' W6 v0 E0 i$ [% m
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
" {6 _5 B; @+ t% L& |; p
t1=sdcms.loadcookie("islogin")
, F  Q5 |9 h. @
9 L0 I# q; P0 I' e7 i, L1 h; p! zt2=sdcms.loadcookie("loginkey")

! [" ]& g" g4 H% B0 sif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

2 M( {2 w6 {' n. X//
5 Q6 i6 e) N! ^! ~3 D! H
: Y2 ]9 a# H: s+ Lsdcms.go "login.asp?act=out"
3 m9 Y1 D% l  P) [6 v
4 Q) b2 R' N4 S- x6 ^) Bexit sub
2 |2 F) x, J3 U( O" p% S! Q
3 l& y+ X* R8 ?/ y7 u7 |. ielse

dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
8 W) K8 l  M/ v0 F8 C+ F
. u) |7 |7 p0 a. F2 @sdcms.go "login.asp?act=out"

exit sub

else

) ?- ?4 V: u* n! c, |/ n, j) Uif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
. L5 l; q; R- J) K6 [/ ~# X
( L2 t2 M" B+ [/ c/ Q6 K3 Q$ Uexit sub

/ E0 ~6 p2 t! m( o( Selse

+ |& D2 I0 v( ]& o! C8 a3 J9 ladminid=data(0,0)
% E" ^; k; e1 q
adminname=data(1,0)

6 d0 n& Y* _) M) Hadmin_page_lever=data(5,0)

7 w; ^+ N+ e, [1 f! l- Nadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

. e, `# _5 F  K3 T: F1 Cif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ a" C6 M/ d' H' K  \8 x
  a4 I) m: W- L$ Y# t( Bif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

* X& n+ i% W" ^0 Xif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
: G2 _: Y/ \$ o5 O$ h2 q$ @
* v! Y  V- V2 A: uif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
0 l, o( }. }2 L2 a2 K# @& F
$ o: L3 p, x0 Ysdcms.setsession "adminid",adminid
# D/ F: M* Z/ ~1 x7 O8 W1 B$ T
# y# T* o/ U; L3 C. B# ?sdcms.setsession "adminname",adminname
7 p  o+ G9 k$ |9 I" M
0 m% D2 K6 N( d2 Y4 e, o  Qsdcms.setsession "admingroupid",data(4,0)
$ D9 O2 L' x! ]6 M$ m
, D. o5 J, ^+ G/ Z& y8 rend if

1 S! F6 x% {. ?6 p0 oend if
0 \6 ?8 s; S, h' O) B4 W
2 Z7 ~9 a# r- e6 hend if
' B! a# U: v. L: Y
. g- w; g+ {1 G& p" c  aelse

9 |5 g1 E" I1 I: V  gdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
& [! K; S  B( P" q4 O7 `3 H, ^
* q0 M" ~! F' t4 Cif ubound(data)<0 then
4 D  ]( H& c7 E/ T* O4 v
7 W" V$ D8 P) E9 j5 j) E( Bsdcms.go "login.asp?act=out"
2 M* a( B- f7 [" K. L
- L+ T$ P" B. l+ s1 x0 |exit sub
$ n' f" O- X" u( e
* d- P( P. g% k% j' F: M9 q2 C$ Celse

admin_page_lever=data(0,0)

' N3 V! h7 R% fadmin_cate_array=data(1,0)

# v7 t0 O3 a3 Z6 |admin_cate_lever=data(2,0)

9 D3 }+ b, |* J. z2 Q  tif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

3 H. ^' g: n5 a9 g3 l, Y6 e0 dif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

! v  R; _6 J$ B, y$ Oif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
4 e( f9 g( z) N2 g# F6 }) H
if clng(admingroupid)<>0 then
/ e4 i5 C7 K9 g5 I1 n
admin_lever_where=" and menuid in("&admin_page_lever&")"
: i! w7 v7 D0 W! }+ y- K" {; J4 ]# L
end if
( y) q+ m; _0 n, n6 V& i) R6 |# W( g
0 M$ b$ u+ D% xend if

end if

+ ]( n5 R- S9 ?end sub
漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)
: u4 E6 `* K  C
6 h. c. I$ B0 M, K8 ]7 gloadcookie=request.cookies(prefix&t0)
: f3 x3 D! D& v; Q5 n/ D8 x
end function

public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1
' D7 J( r' R: M# b& C% a+ B# l4 [& T
end sub

prefix
; M  _9 B6 R" [# c
: b! \1 f0 P1 x'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix
3 i) V$ n/ R; \+ k
$ v! x: m' V" h! I7 u5 N/ w- [. k% Fprefix="1Jb8Ob"

7 K! w. u" Q3 u'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
& C6 W3 J7 N0 G
sub out

) h' x9 B1 n7 L' U4 ?' qsdcms.setsession "adminid",""
8 o6 J0 f% w; t( H( {; D
4 A* c. r( k$ a& R; Vsdcms.setsession "adminname",""

8 G# q/ g4 d) K9 O3 B8 ~+ ?9 F0 usdcms.setsession "admingroupid",""
" s2 b( `6 K" e% X  x
sdcms.setcookie "adminid",""

. |; w$ t$ n( v  S; Usdcms.setcookie "loginkey",""
  S* m% e4 |# e( u# J" I
sdcms.setcookie "islogin",""
, ~4 x3 R) Q. V8 O
3 H1 W2 i" ?$ g9 q  E* u" tsdcms.go "login.asp"

; ]9 Y; K3 a  W% `+ L4 s+ Lend sub


9 U- w. i1 N6 P! h  N* a- I# b利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
: G* S: H+ h2 z2 z" |修改函数！
! n/ [% {2 O+ |1 K+ q# J