SDCMS后台绕过直接进入漏洞

admin

要描述：
/ H" e7 n/ ], o2 l6 P6 ^' L! P  B
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
( E5 O5 T( [- M1 y" g+ `Islogin //判断登录的方法

sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

5 I5 G! }" H$ e9 c4 ^$ b4 u1 r4 kt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

" p8 w2 `9 s6 ~2 F6 ut2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
( Z* B6 i# q' f! ?' K
2 m! r( s" f5 s$ t( K//
8 j6 ~9 V  c( _% _
sdcms.go "login.asp?act=out"
) H2 r  g+ x* |+ X$ h
7 P7 H) Q) W$ b2 T) Iexit sub
) B* X& h( d7 ]" [0 b" P
else
1 r: X5 Q$ x+ w+ o* C9 v
+ e; d6 H% M; G/ B( ^/ i* Tdim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
! ^( d/ j9 }; \7 v
4 N$ g$ M5 f# D" l0 D8 Aif ubound(data)<0 then

sdcms.go "login.asp?act=out"

; \, ]: W/ j- E+ a+ A, z9 b( z  Xexit sub

else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
! c' m+ `1 ~9 C
3 v& r" ~3 R( `9 T2 V0 v; \sdcms.go "login.asp?act=out"
9 Q+ }  L, |1 z
exit sub
% v' f+ ~( p7 a+ U* o( q6 ?
else
5 t7 m- f$ ~! R, f; Y$ ~  `9 h
adminid=data(0,0)
9 ^3 G) z1 A1 w5 W7 X# G2 _. I. U! ?
adminname=data(1,0)
7 H7 X+ `* G2 f1 E- Q
: D" `& d/ ^5 A; k* padmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

* T+ {! u- j# ]/ f' N& @if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
' h7 D% Z8 ?( Z* [  e1 |! b
6 p  r* h9 k2 Dif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
& \" d, G" }/ i# X) E# P
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
& b8 K9 o/ q; O) I
6 s* r. {( l1 `if clng(admingroupid)<>0 then
: x5 a( b3 {( ]- E! V9 c- q8 G/ h
5 j1 g9 q: C) @+ s) p( G$ Sadmin_lever_where=" and menuid in("&admin_page_lever&")"

1 d, F$ |  _0 Y; t* }( X2 ?end if

0 {' g& T* d' O7 _" vsdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
* }3 O4 Y0 e/ I9 c  N" U$ {
3 R1 F  W$ @( o6 w# I3 ysdcms.setsession "admingroupid",data(4,0)
" D1 ~* s2 ?( y/ `* k# Z
end if
/ Z$ P# R) K0 k8 J
. P& ^, H3 z, [1 Send if

5 X4 C, }! A" M) P8 xend if
+ |5 n/ J6 P# @- E* ~# M4 L
else

! j3 _9 A& Z' O, ~  ?data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
4 {! v- Q) F: N7 L2 k& A( Y( o& X
8 K( f# e9 Y0 Y; lif ubound(data)<0 then

- J4 X8 y9 r& l, _  R# jsdcms.go "login.asp?act=out"
3 g( B; c! c) @& I/ m0 @  D
: b! O+ n. Q# Y, nexit sub
/ N- \! F1 b: ]8 V
+ h/ ?0 t9 H: `- v5 u0 O9 yelse
  A$ h- n0 {; q+ Y
4 ]3 o" `* a$ w1 s4 L/ K) Dadmin_page_lever=data(0,0)

# V1 w/ ?1 j2 @' l* y+ Z7 jadmin_cate_array=data(1,0)
  W" [8 x1 y" O8 G
" I  z0 ^" Z; @( r  y) nadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
: z$ s; F% Q3 T. o6 ]0 j
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

: y/ r' }# ~7 f+ pif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
/ e8 v% o0 b& e1 f- w" G
if clng(admingroupid)<>0 then
2 @* }2 Q" w8 ^8 a8 s( g; ?
admin_lever_where=" and menuid in("&admin_page_lever&")"
; h# n4 V5 p' z; w, {( i. W' Q
. G5 z+ x0 G4 D( cend if

5 p" q' y7 \3 V& v6 Dend if

& e1 G7 ~% Q+ w# \( }: o) J) Xend if

end sub
* k; f- N: X4 M% n; t9 s& J漏洞证明：
看看操作COOKIE的函数
8 j+ F' I- X( L+ S% o. S# J1 C
public function loadcookie(t0)

- e3 V3 T. q; r5 r8 F- l7 uloadcookie=request.cookies(prefix&t0)

) G! V: U1 |& q1 q0 r( _end function

public sub setcookie(byval t0,byval t1)

( I' }4 M+ ?2 P! M4 Presponse.cookies(prefix&t0)=t1
5 x2 {1 ]; Z  [) v
' L, u& U- @4 yend sub

prefix
7 Q( F% H( v3 _7 _& J3 t
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
: A# H8 x( U- ~) m
dim prefix

prefix="1Jb8Ob"
. s6 H& _9 Q% w( D; ]4 W
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

3 A4 z; W1 J& M5 f  {6 ?sub out
/ p6 H: H- n* i0 H! H5 ~/ }7 k6 x
( V; N  ~$ p( _sdcms.setsession "adminid",""
6 x( `- Z: V( D' y) g+ A
sdcms.setsession "adminname",""

$ i3 M# N. J8 u9 u# L0 Ksdcms.setsession "admingroupid",""

" }/ l  w% ]9 I; q9 dsdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
( M' T- ^) R; R* x4 b7 H
sdcms.setcookie "islogin",""

sdcms.go "login.asp"
  ~8 C; G3 D9 L+ N% i
2 X# Q3 S- r& _2 C5 D' K2 r  z; }end sub
9 P& g" K# `4 l$ T& n

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
- }, h+ a$ R( ]8 Q% i1 {4 S8 i修复方案：
修改函数！
& |% v# Q. N, O3 m# k2 I