SDCMS后台绕过直接进入漏洞

admin

要描述：
" i9 O* D, b+ i2 W9 a( X
% h1 n& a" Y1 I0 K1 K) e5 U; KSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
' A) k2 ?# |1 `' R6 s/ |详细说明：
Islogin //判断登录的方法

sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
# f% r! ]$ V/ Y
; b7 O+ |1 v8 ~2 \! q' |dim t0,t1,t2
6 g( [' M4 E: e
% ~: s& `) H* l: B3 g( ut0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
% E7 p% |% I" A
3 [+ H! n' A1 X+ \3 D* ]t1=sdcms.loadcookie("islogin")

8 U2 @" U6 z$ Dt2=sdcms.loadcookie("loginkey")
7 z4 i& k. X( r9 @
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
/ y! Y1 T. J5 v
//
! w3 |! I0 f) k. c
sdcms.go "login.asp?act=out"
0 y" ]) j) ?2 t6 q& y4 K
& ^. t% Z5 v6 ]$ J; Iexit sub
$ t& K9 f; b  b1 E
else
( h! R% l, U( |5 R7 u  B3 c$ C
dim data
+ O; C& j# {. r* @8 Z
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
; I5 ^8 Z% F7 y! l( F( a' p
$ v. H8 d( \) H1 M$ Wif ubound(data)<0 then
8 [$ X: C2 r3 G' \7 _( p
) y% p4 o2 \: U# `7 L: G: E& ?sdcms.go "login.asp?act=out"
% E7 P( L% _  @  `! N6 O8 s
% K+ x2 R$ w1 w; o9 w. f( Aexit sub
8 a% P4 U! m. ?9 R
5 R+ J) Q. J) S; z, F+ l) Celse
# F8 N$ p! B, m+ }
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

# o$ |1 M: W& `7 M# wsdcms.go "login.asp?act=out"

exit sub
2 _, ?, o8 }: @
else

+ }. `9 g. V1 U/ H+ k. K6 [adminid=data(0,0)

adminname=data(1,0)

admin_page_lever=data(5,0)

: X9 X/ T( O% F0 w# Xadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)
- ?7 R& O7 J" l. a
6 y1 n+ }9 G, c- ^$ A8 }8 gif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ v# C; P9 |' |4 K) A! t  N
1 p2 r$ l3 F% `) y5 e/ q7 y' eif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
, ~$ u4 ~* P# l0 C5 S+ h
/ s" r! f. }+ @0 N# nif clng(admingroupid)<>0 then
  K/ U+ K, Q. Q3 m0 q) p: ?
% c! Y# j1 d* b4 f# Z0 `- B! wadmin_lever_where=" and menuid in("&admin_page_lever&")"
9 c! @+ H1 R; t% V# d) J: Z
( H# L+ a; ?8 ]; vend if
) p0 ^# w2 h* l' i* [3 k7 R
sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
/ m8 @$ P  ^6 F" d! c( `
" @0 g1 ]+ y' h0 g/ f/ ?$ Ksdcms.setsession "admingroupid",data(4,0)
) d1 u8 `5 ~4 \2 g! N
end if

end if
5 n, g  y% \6 [4 C6 H9 _
, A3 \0 |) c) X6 x; }# `end if

7 x# ]* M9 J- w0 o* V3 f* zelse

% C; k; A, G  g; ^$ w3 Wdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
9 Z0 a+ f2 [3 q% {( R1 U  ^
2 O& ~% Q4 F: x1 s4 ~% j8 K* C1 dif ubound(data)<0 then

) A  R, F! v! k: n( |! }) u3 lsdcms.go "login.asp?act=out"

& C3 }& y! _5 S' X8 N4 x2 w/ uexit sub

1 m) [+ |; y0 ^' oelse
9 m; Z+ ~2 S6 P" \4 e' B* Y
6 A' I, O6 q( Y; M" y& W3 ^3 |admin_page_lever=data(0,0)
% O( E6 P+ L7 ?! {1 s
admin_cate_array=data(1,0)
3 S  M% P7 v( [2 T* M
( {( Y! b7 D9 g4 l3 ?admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ f# x9 Q2 C  G2 y" ?0 [7 f
0 [" K1 t3 P9 E6 G' Xif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

: j$ ^* J+ l+ Z7 t6 T. i( g9 Kif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

& e% \5 x& G6 i- {% c& Nif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

2 \5 D" ?& b0 q( x7 kend if

% w- N. I& N, T7 @( t7 K6 X; Aend if
5 k, i4 ~; D/ E! j* b+ W
end if

end sub
# M; p8 H. n3 ?% t2 ]" O漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
7 }5 Z8 Y1 n! C: |) R1 H  i
end function

public sub setcookie(byval t0,byval t1)

" u# D" ^, L6 V1 a: Sresponse.cookies(prefix&t0)=t1

end sub

prefix
! R# O  U( R8 c7 f, S" L: d
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
* e, f9 i: G" |. |
2 e  X5 \) l; @- x& o9 Odim prefix
( K  P4 X' R( u
% O* X* R" ~9 Yprefix="1Jb8Ob"
5 m: j8 t8 m8 S9 U- Z  ~5 I/ j
. K: Y! ^$ f: {) l+ ~" e3 U! L'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
  \, h4 V/ _: G9 d, I& F/ u, p
, e4 o" {- `" d, B* t! L/ isub out
0 b% K) ^% N8 L9 A# q" y
0 e: Z- p3 |( J* ~6 u* m; y4 fsdcms.setsession "adminid",""

8 G) a: `8 F2 k  R. j/ Q. H, ysdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
9 t1 ~! s& W: E- M( {
2 O, r6 E7 B, C) osdcms.setcookie "adminid",""

! D" ^3 F" j" Q. `5 R, a# d* X* asdcms.setcookie "loginkey",""

3 @/ F9 ^  A% W! d" vsdcms.setcookie "islogin",""

sdcms.go "login.asp"
6 _9 x' V% F& ^  U+ f" e
end sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
9 P! |# c. E3 _! Y) x+ p! r修复方案：
修改函数！
4 S' M! ^- W- r2 q$ S- a1 A