SDCMS后台绕过直接进入漏洞

admin

要描述：
3 G$ T3 v3 I: n- K6 l9 T" P
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
6 K9 L+ ?# e" w5 y* C6 g* m/ ]' x: c
3 g1 G$ C! Z4 u: A8 g  e5 qsub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
+ f; x( f3 _$ e6 B
+ Y9 d- t6 c- {; V) Wt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")
4 j, i8 N( \; G5 Z; Y7 l
t2=sdcms.loadcookie("loginkey")
. f0 k5 y/ V1 R: W3 c& @2 ^
; ]( d+ w( V$ V& }( Z7 Sif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
2 J  S7 O4 ~8 c  v0 J( |  Q
//
1 c: U* S( B' J& ?) R5 R3 r+ d4 o
sdcms.go "login.asp?act=out"
# N+ f, V" y$ P) h
exit sub

else
( [$ ?1 ^6 i$ ~' H6 w9 b- J
dim data
+ ?. k2 ]+ `* O( t/ P+ F/ T
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
; V- W; f- {: h8 z! B3 k& T4 k; [
if ubound(data)<0 then
$ b! v. [' n5 H8 J, ?# K
6 C$ s7 E) f! i+ {( L0 P. O& isdcms.go "login.asp?act=out"
# ?6 j! [. p0 D
exit sub

: R: G# e, P6 t) Q" c( Q6 yelse

" a9 z5 \& T# E" Gif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

2 y! r0 N3 _! z+ k! T8 K0 ^' E' esdcms.go "login.asp?act=out"

7 H1 Q: W- F1 j# L! P0 I* {/ yexit sub
% W  K( k4 q& n# Y! \
+ {6 @# e5 d$ _7 a& yelse
- b) t0 }7 ^  f% X1 ?  n
adminid=data(0,0)
$ o2 j8 Y5 G  J2 _2 [1 W
adminname=data(1,0)
- E+ w" H3 X& d6 w# ~
admin_page_lever=data(5,0)

admin_cate_array=data(6,0)
! ?3 R7 J2 F/ E; R/ v4 v
admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
7 S1 @/ n2 u% ^6 g& G) Z
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
9 K- |% J/ T3 {5 l; ]+ R
if clng(admingroupid)<>0 then
$ z; Y" C8 H! T* s0 A. N  b
6 M) u$ t7 N* z% A# aadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

sdcms.setsession "adminid",adminid
% a$ `1 Y5 H; ]* f% I% Z
  F) @2 j; K( g2 L* p. zsdcms.setsession "adminname",adminname

9 q- l4 ]. J1 E, h2 fsdcms.setsession "admingroupid",data(4,0)

end if
6 ]  R2 }& S+ L- T% |4 T! {
end if

% F8 ^- |- A: _- \end if

! |; g+ z1 B# D' jelse

: W, B$ P* d8 j0 d8 L. wdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

+ @# V4 d" [( l3 Vsdcms.go "login.asp?act=out"
( {) @" G1 [; B  Z& @  S
5 k# ^% j* h/ a* sexit sub

else

admin_page_lever=data(0,0)

admin_cate_array=data(1,0)
6 x7 b1 L) F, O3 q3 C
2 U% h: O7 @; B1 Z/ H/ `' Vadmin_cate_lever=data(2,0)
* s: @% b8 `0 M% [9 c
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

" O, w# V8 F* P& W$ tif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

7 w. i$ d0 [% p0 k  l8 C- Rif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

: E( d% K3 a/ ?if clng(admingroupid)<>0 then

: d3 o) A4 v& T. N' gadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

end if
& ?' f& [% l! P( V6 |
end if

" X2 F0 `# i/ K" N+ B( D! _end sub
" l& \$ q8 p- X- a, S- G- O漏洞证明：
看看操作COOKIE的函数
/ w" ]8 C# M; r. F8 r. l8 v- z# m
public function loadcookie(t0)
9 O" f- s; T* E8 b0 ?% m
+ U1 G# X0 _( o5 Aloadcookie=request.cookies(prefix&t0)

4 P" p5 C7 n5 Bend function
7 R8 K2 F  f9 J  d4 b" q0 X: [0 n: F
. _% L% K! E4 W! C1 Epublic sub setcookie(byval t0,byval t1)
, d% W% v9 `* k* k( @( j
response.cookies(prefix&t0)=t1
0 I5 V: t6 y4 t* B
end sub

4 `1 v2 c, \9 t. e1 F* S$ fprefix
8 ?" C9 Y7 v& I- S' D, k
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
0 H& D1 C# J0 h
dim prefix

" q! a( T, \& ]0 r, k% Eprefix="1Jb8Ob"

2 i2 c7 ~/ H( w2 ^9 C' K'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

* T; @' \6 f/ c4 I; L! asub out
7 a) h& I$ H8 d5 F
9 q5 q; ~$ m4 j" T; U& tsdcms.setsession "adminid",""
) L- E6 x# L/ L& Y) b0 y
sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
; \# w9 l5 F4 b) |) ~
sdcms.setcookie "adminid",""

; C1 F- h/ H3 ^3 \+ msdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""
& y: n# Z0 e9 b$ d
/ g  z; C% I0 @sdcms.go "login.asp"
$ @6 c2 F& b7 o7 c* r
end sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
- v& {% ~0 ~6 j; S0 o$ x5 ~修复方案：
修改函数！
$ p6 f0 z& w( z8 T, f