SDCMS后台绕过直接进入漏洞

admin

要描述：

! u/ C: _# ]2 s9 X+ T& iSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
7 s6 ~  d* c8 T/ |7 `* P详细说明：
4 c  ~- f% b+ ^' s; dIslogin //判断登录的方法

! K2 Z  Z* V/ t7 X4 |2 B# j! Rsub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

2 g/ }2 y' N& E8 }t1=sdcms.loadcookie("islogin")

/ j8 w+ z/ P& qt2=sdcms.loadcookie("loginkey")
7 w5 I: b; t2 K* y/ ?4 X/ ]% q- u
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
7 R# N4 K9 H! n7 Z3 C
3 G4 m1 P5 X* `. Y% O4 f4 }//
. H- E7 E' Z+ f% S; n
+ O8 A/ a3 N9 Wsdcms.go "login.asp?act=out"

* a7 u! b9 H5 Rexit sub

+ g" c1 ?2 e" I, F. nelse

dim data

4 _5 j. o$ \! f. N$ R3 Mdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
$ E2 l* m& l% w) V
  t0 K, N3 W& m8 F, ~  P$ Q: j3 `sdcms.go "login.asp?act=out"
9 J; u% s$ Q5 S. f) X+ z. k
" s9 M  k% Z, H% ?exit sub

+ m: N. ^( {  g- w) Gelse

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
, ?, {" N& l) A) |/ \9 x
sdcms.go "login.asp?act=out"
' W" W4 @2 m2 V5 i  V
$ ^9 Q/ m4 }" a8 o4 x3 a  [exit sub

$ s  _# s; X- ~0 K. celse
+ {+ B/ J, X; `. q9 ?( }
0 @: `/ M+ f9 ?/ dadminid=data(0,0)

; j2 `4 C- d+ madminname=data(1,0)

admin_page_lever=data(5,0)
. z* Y, d! _5 P4 j% x1 E
admin_cate_array=data(6,0)

8 p8 |9 w; L, u# g; L: h; Z" ~+ Madmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
1 \- p8 [: t0 F4 l& t0 v
4 ?6 R# U8 }$ f" l, L9 N, y# rif clng(admingroupid)<>0 then

5 j1 S. a+ l1 v: b0 Gadmin_lever_where=" and menuid in("&admin_page_lever&")"
  S0 B0 Q5 E( x
% G( Y( U& G8 F$ w1 xend if
( V8 |! N$ }* a/ p% [- m
: K' J- A9 W/ O8 J1 ?# \sdcms.setsession "adminid",adminid
0 B7 ^/ P" k* Y" y* F0 W' t4 P
sdcms.setsession "adminname",adminname

7 @7 l1 W4 `( l7 Bsdcms.setsession "admingroupid",data(4,0)
% m) T- u! ]! {
end if

7 u' m, A) u3 r1 F# f0 D% q) Uend if

end if

7 F; [. m& B: s! zelse
0 a. P6 L1 G  D: F1 p
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
* k7 W7 x3 c' s! E6 V! I
  d4 W: a* b4 Iif ubound(data)<0 then
& O- V+ M6 E5 J" d9 o! {
9 f% [7 o! E$ x' M# jsdcms.go "login.asp?act=out"
4 k/ g' i/ a4 ^; |* g1 \$ U6 ?
0 P$ w5 K" f; m  }exit sub
* b* M! X9 m% \. N: x5 V
$ }1 v. S' v% P) i! zelse
" M0 m) b5 K3 U6 M; i
admin_page_lever=data(0,0)
% Y9 K) y9 ^8 [: b& I
admin_cate_array=data(1,0)
0 t8 _. s$ Z! c1 k
& E& q9 |  M+ O$ b3 Z" O. W. m( Madmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ c6 N8 e5 J% ~. |
! n+ b, T' F- B- Y0 kif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
  S8 }! G# R) F, \2 D* F! a
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
' B! P( \, p* J) Q# g" _9 x
if clng(admingroupid)<>0 then
& i1 y1 J- H2 O6 X1 Q
admin_lever_where=" and menuid in("&admin_page_lever&")"
! L/ X, @+ B( S2 Y; q
end if

end if
- ~* G6 t* e2 A% N
end if
7 c7 P/ p) w4 p2 H* r
end sub
漏洞证明：
( o7 P& @# W2 C) u# J1 M: W看看操作COOKIE的函数

public function loadcookie(t0)
0 l: Y- p$ V) t0 a7 D/ z+ n
loadcookie=request.cookies(prefix&t0)

" [) I  s+ V$ P! k' w# {  r* Send function
8 e$ w& N3 S. n- P! l1 ?8 }
; u3 y# J9 b8 C) qpublic sub setcookie(byval t0,byval t1)
6 D# d, l) G& Q! V" E, f- h
response.cookies(prefix&t0)=t1

( P2 Z5 J& Z2 ~end sub

prefix
& L7 ]% c% {- O. Q! F) ]
' u( e6 u' b4 @4 U* }0 O'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix

prefix="1Jb8Ob"

( k/ C  ]% t- t, l2 n'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
8 F8 l, a! w0 \) C& n: V
# F, D5 z$ K% m% ]sub out
' A- n( e- c0 p+ q7 m* S( z4 A, f+ u5 K
7 `- l, ^6 c( f* \) `' Q$ Ysdcms.setsession "adminid",""
) p+ i5 X) s7 h% _
( `6 Q  }/ e1 d& ?' P) y' C% Z9 esdcms.setsession "adminname",""
: M6 W$ w) E4 o1 ^
sdcms.setsession "admingroupid",""
' L/ l! _  R0 E8 |3 B6 x
3 K, x' f$ H2 Zsdcms.setcookie "adminid",""
: ^( q" f9 N0 @6 J0 w
1 U5 f* o( |( h4 n1 E$ l6 I, vsdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""
8 }5 a# y6 c; R/ F! f
sdcms.go "login.asp"
% @3 i( E( E( K' Z; r( s' C
$ Y  V3 _4 v  h% \+ I3 g% tend sub

! d7 y! V% X( N- ?* C# X
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！