SDCMS后台绕过直接进入漏洞

admin

要描述：
  y# o* e' }4 B
0 {  B- a4 o, a; Q) G) bSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
! T( z& w4 @5 [: c7 B4 G0 {) E
* ]0 @6 M! t& h8 b8 ~1 Y. ]& [sub islogin()
' P' ^6 f0 W: Y: j$ g/ L
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

& p- M8 t" a" tdim t0,t1,t2

5 _% u( B$ S# r6 }. _' vt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

' \; ~* u) y+ P  d9 `( Bt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
5 `( J% c  Q0 j9 D- P& K
8 Z' g6 Y- y$ Y% t) c% c4 x, ]/ q2 pif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
* J7 O$ [5 {6 }) p# j/ t7 B
' Y2 p% K( n% V//
& b* W6 M4 Y+ e+ {# }0 h# j% G/ @
sdcms.go "login.asp?act=out"
. @( g+ }9 d9 C6 q4 w
exit sub
9 i, ?: W! L& v
else

dim data

' i: B2 i4 Q/ u2 [data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
0 E! R# Z( l; O1 S
if ubound(data)<0 then

+ i& p( @) h% r) r! xsdcms.go "login.asp?act=out"

exit sub

5 ~- y! X' o  x2 D0 delse

% n0 ?  O- v2 w* F8 q) Uif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

5 F' h! ?( x6 X; m, L8 k- J9 jsdcms.go "login.asp?act=out"

exit sub
4 B5 Z& X" u" O- E# o1 v
9 [% G. z/ p0 S" o% uelse

$ W) ]2 a% w; v6 d' X! ]; oadminid=data(0,0)
+ H( A9 t! s* L5 S! e7 ]
adminname=data(1,0)
' \% K) @' p% N
- s* e1 e0 x: k$ l  P8 i) oadmin_page_lever=data(5,0)
/ v$ R# ]2 B; o5 G
9 {0 G- B7 Y9 F! ?% Ladmin_cate_array=data(6,0)
4 s& U8 A) G9 j
5 Y6 l$ Z% E! J# x" \admin_cate_lever=data(7,0)
' m* c7 a3 P$ V3 L/ G/ m* e$ Q  v
3 e7 l* ?- E  }, w* Dif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
8 f) {) P% G( h/ N% G
4 u( _! r$ |1 V& v8 ^admin_lever_where=" and menuid in("&admin_page_lever&")"
( k, o% t2 V9 V4 ~! J% {1 k
end if
4 c- W$ C  m  x6 ^7 ^
sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
6 W. M$ G# {; m. A% V! W% m/ Q
1 q$ J+ R/ N) \0 L/ l+ w" Lsdcms.setsession "admingroupid",data(4,0)

end if

- z! _% a4 F4 V5 |end if
6 w" [+ l- O0 z, S# V6 y  }3 N
end if

3 r6 i5 D, v0 d* [else

& D1 y) T( r4 ], u8 F8 V. udata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

7 L+ D# F" o* N  l! mif ubound(data)<0 then

% K# L) t* L5 R, Vsdcms.go "login.asp?act=out"

exit sub
" G+ g. M/ k" w" t& o
( N( {& A5 p% |3 O4 a* s4 O+ Q1 pelse

admin_page_lever=data(0,0)
+ l, j0 k( A; D! s7 T3 ^) M, k
6 P2 s  {7 w! J5 R( o  C/ l# ^9 ?admin_cate_array=data(1,0)
) G) s+ T  k0 }& F9 |6 e1 e
9 H1 D9 S! L8 `( \/ O$ I% M9 T4 A; s( madmin_cate_lever=data(2,0)
8 f: w) q+ r9 k0 M: G: [0 w1 d
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

5 L3 j! U6 Q# ?4 K5 {' Iif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

& [9 X- c: D  A) M! eadmin_lever_where=" and menuid in("&admin_page_lever&")"
% Y2 I% K( _/ H4 ^* A( {
- I) ^* |0 J' K+ _5 ]end if
' k% k% w6 a1 ]' \
end if

end if
- }$ z+ q( D% O& r8 [: U
end sub
0 R% _. R9 M5 |) V+ L, X3 S漏洞证明：
; F  ?0 b) Y* q  I3 g3 }$ M) R看看操作COOKIE的函数
- `3 S# N1 V: H' O3 q: Q% s& Z
public function loadcookie(t0)
, I6 u- s' p$ V# R
* U. _. h" T) m1 A0 J/ W$ kloadcookie=request.cookies(prefix&t0)
6 F4 H: S4 w* H$ x7 Y6 F0 T
; e, q' s; r  r' tend function
5 a) N" e" f- K
public sub setcookie(byval t0,byval t1)

6 }0 ]) m3 a/ L. M- sresponse.cookies(prefix&t0)=t1
) Z1 P% \% b8 v1 g  e
end sub
" `( v$ X1 r) t# V0 O* p+ A
& I4 W# g( O: l. ?prefix
" _% M' N4 V$ q) n8 E+ d. e- y/ a
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

; ]3 ^2 _3 P' |6 k$ ddim prefix
$ X2 _; ~' }% Z1 t0 N0 ^, T
, A# N. \: Q9 Z( A3 qprefix="1Jb8Ob"
5 ~# r4 w% A' W# c$ V4 M$ Q- v
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
; d2 L6 f# I& Q- x1 ~5 o
sub out

, W  {/ Y, _+ N' d: csdcms.setsession "adminid",""

$ `7 O& w9 a' b. u4 E3 Esdcms.setsession "adminname",""
& z. a& ]* e% Z7 J8 S) T  @
( i1 W# g& [* {, Y. C& esdcms.setsession "admingroupid",""
) K  S" Q4 n3 @: v+ k1 Q
) `: f2 h( J- E0 F4 G6 _0 Xsdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""
& U+ q& t0 Q# [$ E& `, I
sdcms.go "login.asp"
. V+ R$ W4 Q9 `3 E8 U, f7 f% L
- P# e# _. H# m$ k4 D& Nend sub
  L: n' o# Z7 n& `

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
: i! Q% p; V& o修复方案：
修改函数！
+ Y3 \8 B) k) o, s* `$ }