SDCMS后台绕过直接进入漏洞

admin

要描述：
! X3 }' Y  s: N4 y& @
+ d: T- O+ d& z3 D8 |SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

) @* E: ^: ?1 ^% c% qsub islogin()
) ]" C/ s! W/ e' O4 T! z6 J6 J
* m' K  `( L9 b' f4 uif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
8 I+ ?5 Y1 \; ~3 P# b3 d4 ^6 W
' t9 d* y  p( `t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
6 j( S/ l6 Y  A+ _9 L
, _/ ?( x3 D! D/ M8 jt1=sdcms.loadcookie("islogin")
7 O9 B( l; J5 n5 o# z0 K
% ~1 A# ^$ ?4 Dt2=sdcms.loadcookie("loginkey")
/ [+ j" h$ d7 j/ i
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
( }, p( d8 j& F. o  D, r( E
//
2 p. ?/ }5 W8 B) T! J% d' Z
7 X: H. |' j9 H; }$ d+ g- v0 v- Zsdcms.go "login.asp?act=out"
/ i% S3 ?  {& d4 L
& Z( F% t( L& G, _$ Zexit sub

else

dim data
& W% J3 |/ M+ J& [. ]
* X: d& `8 y. edata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
# q( i! l( G) F: z, @2 _
' o/ H; v4 n* ^; |if ubound(data)<0 then
! `: L2 `6 `: d+ N
sdcms.go "login.asp?act=out"
: w$ w3 S1 v; t6 k, \  n
exit sub

/ g, Z  ]4 b4 s) }% f" `else
4 ]7 m, _  k; h9 Y8 T. K$ d
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"

exit sub
! P' T8 c+ E+ Z5 A, y8 u/ w1 e3 U
& j6 U* D9 w3 Gelse

( M' k5 n; b1 E! V& e, wadminid=data(0,0)
- Y# W8 v- G5 O' s
adminname=data(1,0)
- S! W, b, T! d+ |+ ~9 B) ~$ P$ ^% F
' q) x# j  _2 k- [admin_page_lever=data(5,0)
3 z  F- k; K( a' h" J
* W1 o* q+ {5 Q1 {admin_cate_array=data(6,0)
: `0 R+ ~% e1 l. l
& ^. j0 K3 B3 V/ A& hadmin_cate_lever=data(7,0)

5 J6 r  h7 B  gif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
; J$ R. d5 E6 n
0 g& K3 k. |. [( rif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
) o& C  k3 M  |6 L1 p- F. c
8 y1 [9 G! h. ^$ c4 Uif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

1 W" m0 M  p  H+ W: ], ]- |' Madmin_lever_where=" and menuid in("&admin_page_lever&")"
! e% W8 u/ e9 R) r2 a- I: _, p
* X' X: f1 u& Z6 ]: n5 xend if

sdcms.setsession "adminid",adminid
7 J0 m( Q5 G& h/ S4 x+ ]- T0 C' j% m
sdcms.setsession "adminname",adminname
7 r" Q, Q' t) @2 `0 S' \$ G& Q
sdcms.setsession "admingroupid",data(4,0)

8 y% e( l5 m, c4 nend if

, \4 T1 J0 G9 Kend if

end if
- h! a7 `/ J1 n- W
else

6 y( Z7 |6 x2 P8 {: ydata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

  D: f' o4 F6 N- U1 c& f' Pif ubound(data)<0 then

sdcms.go "login.asp?act=out"
9 e) g+ y, m+ ?& G
exit sub
& j$ c8 p; P6 W/ M' `
else

admin_page_lever=data(0,0)
: t9 X. p3 U+ X0 x
admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
# G; q- v+ ~9 m
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
9 i0 M0 }7 h$ b) b* g
) g( p. }8 X; M! w7 Q% m2 s. ^if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
) e4 K) V; x4 V/ o( K1 H
if clng(admingroupid)<>0 then

4 ?' H4 N2 ?9 x* j+ g4 cadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if
- A. p( u3 [* `* y$ r, P
end if
8 _, X7 [# p3 P, X+ A* D7 A
end if

  B4 e5 Y1 Y& G0 L$ lend sub
1 l) o0 ^8 l  z( J漏洞证明：
看看操作COOKIE的函数

+ d" t! p% b& m6 ?: Tpublic function loadcookie(t0)
. ]+ A4 x( Q! C1 C
( ?, i( E+ \' Rloadcookie=request.cookies(prefix&t0)

end function

public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1
; ?) x& X( @2 b. @5 ^
end sub
" X  {6 f1 E. U8 \
2 f. o" d+ a% F( h0 Yprefix

0 J$ @; B( G  V, y, J, V6 o'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix
3 ]7 u2 F2 W7 @( V
* L& Z# b+ T: n% D  }prefix="1Jb8Ob"
0 b0 w& g# R% C* S0 C
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out

; f. ^( @+ \6 m( O- {! ysdcms.setsession "adminid",""

* ^) A( a4 b( k: a" @! Y8 Osdcms.setsession "adminname",""

) j  K- [: K' Z: o$ i# lsdcms.setsession "admingroupid",""

6 r; U# z' I8 [7 _% Ssdcms.setcookie "adminid",""
  u. N! H) H- x" R9 w/ M% i
sdcms.setcookie "loginkey",""
" u6 n& w' e$ k! ~0 @1 S/ j
( D( G6 z5 X6 H& Rsdcms.setcookie "islogin",""
# t* E8 ], ~# |2 T
sdcms.go "login.asp"

6 c  m3 G- W9 [2 K" S' ?+ ]end sub


% S: L( k' g5 x利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
9 x# X$ F/ }4 i, ]/ P1 J! M修改函数！