SDCMS后台绕过直接进入漏洞

admin

要描述：
4 w1 U( i! z# f* G
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
# i2 d$ m' @: f' ?详细说明：
Islogin //判断登录的方法
! \, y( s+ O, e7 ^8 s; Q
: [6 b; [/ B" L# ]sub islogin()
/ [3 U) W2 h  Y7 l1 U$ N7 _  r
+ r8 j& D. g3 b) Wif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

6 u  g1 z) p2 U3 kdim t0,t1,t2
- t% N/ V% O' a5 R# s6 s2 u5 Q/ `
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
" \/ s$ o. r: Z. c  E, K  x
% m( L3 x# |5 }5 x; y. R" ut1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
3 X5 d! t8 X5 e  r
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

2 h: ^) }7 H1 [5 j5 S5 {1 G% n//

7 D/ f9 @' P1 H8 Z+ A3 a) Bsdcms.go "login.asp?act=out"
4 U0 ?% J- V* {" d* b
% {# F! d& G- ^% W( o; R, bexit sub

# J+ C) o1 s) l% b4 Telse
! H% d5 K9 i" p8 l' S9 P
dim data
5 u& e8 g) c8 \8 ?% }5 f9 c9 }/ y6 V
3 W% w  Z; ^6 P+ adata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

9 s! Q2 Q3 I( Wif ubound(data)<0 then
) I9 R0 d+ I1 `% b: P9 \
sdcms.go "login.asp?act=out"

exit sub
, ^# t% u$ H2 d9 G$ W2 M: `
- i3 N8 M5 u4 f. Y2 A. U7 A  Oelse

' C4 w  ]5 W* c, F4 w! e, Rif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

# c! G3 M. r) }9 A# g% lsdcms.go "login.asp?act=out"
% n5 F; r+ d5 V. r0 C
; {3 y8 u, ~; `$ c7 {4 wexit sub

else
0 T' {# H  k: X7 e7 h) [/ ^
adminid=data(0,0)
, R. I5 e, I4 K5 ?' o
adminname=data(1,0)
8 Y- D! D9 `; d$ N' e& P
* t% j* G4 Z  }  y1 D) Wadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

! \+ U" u5 i$ wadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
( {+ |' U! [8 B& Q; W* y( N2 G
9 f( O; W. q& Z  K' {if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

% p8 h9 i1 k" h) I, Xif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
0 u3 G3 G7 I* ~: w$ g
( F9 K1 E* m3 V( q; n2 k& j; rif clng(admingroupid)<>0 then
9 G. C0 T( V: W- L8 r) V7 o5 Z0 h# I
admin_lever_where=" and menuid in("&admin_page_lever&")"

! X# ?5 X/ K4 Iend if
9 b( m$ {2 z; {/ d
" o7 t; B9 [$ q( O" z5 tsdcms.setsession "adminid",adminid
4 }8 m( r6 n. ?# |6 c
sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
- A" W( Y9 h* s' J$ [( d5 L
end if

4 {6 g) |! ]. t8 T+ _& Bend if

7 w; \. h) ?$ ^' z, h" Iend if
/ G& F8 D6 \( N$ O$ b3 y- O2 ?
5 J2 f/ I2 }5 n% u1 Zelse

! b9 S* h9 p: S  @  S9 ^$ D4 q. _' Fdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
2 ?6 Y! ?- B% H
5 K) P! _0 [! K; U, Pif ubound(data)<0 then

& Q' \3 x# C' L" e3 d0 xsdcms.go "login.asp?act=out"

exit sub

9 ~) `7 X( o' f, v5 yelse
- ?# s( V  y( n
4 ?+ P1 C1 E( G& r5 ~admin_page_lever=data(0,0)

9 F$ O( L$ y: t8 N" M/ fadmin_cate_array=data(1,0)

0 c5 X% ]- D- z' q9 Y- sadmin_cate_lever=data(2,0)
+ k5 X. |$ y9 |& b8 J5 u& L- @
2 s" m: z7 @; Aif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

! l- v* m0 h0 Z0 Uif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

1 u) ?% n5 N1 J. B: F5 h) O! R% k0 qif clng(admingroupid)<>0 then
8 r& e# t+ q% [7 l& @
( Z1 P, T9 z0 j$ |1 o' u, gadmin_lever_where=" and menuid in("&admin_page_lever&")"
9 S8 ~9 A4 o& Z* y+ N! x. r+ g
end if
8 Z# @8 j4 Q6 Y( o
! _/ R( I* [. |' Vend if

end if

end sub
, b3 [6 I# m" @% ~, j- \. l: C漏洞证明：
看看操作COOKIE的函数
& \0 e" o" d" J; O& c
) s4 l3 L0 _3 l# S1 J4 ]& Cpublic function loadcookie(t0)
: \) q' O1 x# Y) A9 {" Z
3 U' R- v) b$ |. Q( Kloadcookie=request.cookies(prefix&t0)
4 r+ l$ I! ~* b: E
end function

) _' X6 {- t; @3 b8 _! {public sub setcookie(byval t0,byval t1)

0 X( g8 ~# @6 y0 ?& ~) t9 c  ~response.cookies(prefix&t0)=t1
$ s! O* u; v' W4 f* f) ^0 I% [
* A1 K) C9 z9 w6 ?0 X+ H, rend sub

0 X+ |# [6 V8 `. y- U8 S4 _prefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
" N' z0 R( `5 j' z9 y
& R6 z/ C6 K4 {  a1 G/ g# _, Cdim prefix

prefix="1Jb8Ob"

% u* g2 T& O% [; {9 l( _'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

  k8 l1 |1 `* `% f8 ?sub out
& _) D  @( L% N* |" c7 [9 k
7 K! }1 f2 S/ X: B: Bsdcms.setsession "adminid",""

6 y- M* b% {& t+ b# Q  o7 b9 b* rsdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
. N0 E' x+ k% K; k; v& e+ g
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

' E9 S5 u  K; _sdcms.setcookie "islogin",""

% n& c8 l; m4 G: lsdcms.go "login.asp"

. o. U0 @8 r; A  ]4 q& C0 Jend sub


/ l( c! z# u8 G) |利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
% r$ V" U" h0 G修复方案：
! g9 V: k; W# {  Z% |" c" l修改函数！