SDCMS后台绕过直接进入漏洞

admin

要描述：
% }. X  k: C. H$ {% G
9 S0 `) b6 u( x2 Z! y2 P. {SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
' I" A8 q# g% H8 k6 ?Islogin //判断登录的方法

+ d! t" a0 M& h7 H+ D/ Lsub islogin()
! p4 p9 P; e- [$ M' v: K7 J9 z6 z3 K
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

8 o! d" d, f5 \/ G5 b5 \dim t0,t1,t2
% H1 ]. j0 {0 [# q  f) w5 ^
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
' R1 e/ ]) _1 _, k' t
t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
, g( V4 b* r, d: G, }7 P
' O( s; K2 j8 ^. @; f  jif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
- M3 M& k, [. G
//
* x% q6 t0 W1 U% P* u9 [$ Q
% \# W# y: X* hsdcms.go "login.asp?act=out"

4 r: }9 y. w, y) O' U1 }exit sub
# |- ^7 Q7 Y. ?6 G4 Z8 g
else
' f  P  p" q* |8 u+ C3 L
dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

$ Y  m& o0 \$ e  lif ubound(data)<0 then

sdcms.go "login.asp?act=out"
* n5 Q* W( @) P6 g9 ~  `7 P; U
exit sub
& b& `: L) [7 I2 _
else
& O( E. r0 m7 h9 E) W1 V
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
. }' Y, h1 ]+ v5 @  q: a
sdcms.go "login.asp?act=out"
8 ^- G5 K9 F6 O: S6 k2 y
exit sub
" k, M" P. I  X4 Y
else

adminid=data(0,0)
2 z0 Z6 K& C: b) X& x2 S; ]
* k1 e9 S. d3 ^" Jadminname=data(1,0)

admin_page_lever=data(5,0)
$ P( E$ D  F+ |* M0 J1 Q0 F
admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

) B1 @! {7 g' Z" U+ u  _$ _if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
& c0 P4 o# f- k3 U' Q$ r5 o
' j+ k! O, W" ]$ }1 J% Wif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# l! ]% k' I5 A3 N
' z* t4 K& L3 \; u* k+ mif clng(admingroupid)<>0 then
& Y6 F% R2 T( h$ B  Z6 W+ x
admin_lever_where=" and menuid in("&admin_page_lever&")"

9 a+ T8 r- k) e3 L/ ]( ^6 ~3 qend if
" d! J) y7 P6 m4 @5 B4 n3 v1 y
sdcms.setsession "adminid",adminid
, N1 @4 k' a3 r7 w  w
( l" m6 _3 R( W( J6 e  B7 jsdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)

5 F. e/ l! E% r3 l0 s" Uend if

end if

end if

7 K6 Y9 C- c6 a/ m: s# c( W: F0 pelse

; D& `5 k  n9 n  n0 J  jdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
/ t' A" K9 b$ B' D7 C. \- O7 i
$ C  X3 Q! M- B6 h# m- n0 kif ubound(data)<0 then
& H6 z& X' a+ E$ c
sdcms.go "login.asp?act=out"

4 T1 l1 X$ m' {+ w$ Wexit sub

else
7 ?5 B1 o' c% }+ ~. X
: Y; Y+ n6 q/ m1 T6 x$ w1 eadmin_page_lever=data(0,0)

admin_cate_array=data(1,0)
7 Q" M5 q: }+ C# L8 c! O$ c- `
+ V0 }7 l9 U# q) @) ]admin_cate_lever=data(2,0)

; @" C, O2 D$ _4 Lif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

. ~) d9 u$ f. [* F3 ~' }5 R0 |if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# S7 z8 x2 U0 W1 j4 U  F
9 b* H- z) o& G7 @9 R+ H3 eif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
- G+ F9 @3 d* C2 x$ O
end if
, l9 ]4 l2 K3 G4 H, D- `, [
end if

1 o$ r$ P: M! Y5 T+ u/ wend if

! {5 ^& n7 c- q: ~" D" Uend sub
( ]+ f6 y0 _  }+ M% e. p! y漏洞证明：
  t0 E! H! `/ v  x' J3 a看看操作COOKIE的函数
7 }3 Y9 V+ S+ ^2 G# ]9 t
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
/ B* O. d. t3 t) h) S
+ Z5 d4 D" n, U# fend function
6 H+ |0 ^7 M# }1 S
public sub setcookie(byval t0,byval t1)
0 o  j. V+ y" Q
response.cookies(prefix&t0)=t1

9 |0 m' ^. {: O, F/ Hend sub

prefix

- k$ p) D4 X! I0 s7 S$ m3 P( h% W'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
. K5 F1 |* T8 w, @
dim prefix

prefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

/ L# v- A& n' O$ g) c+ `' osub out
( D) d: G3 B1 B4 o! a- f8 H$ b
sdcms.setsession "adminid",""

sdcms.setsession "adminname",""
0 s5 @& `( v0 _6 E
sdcms.setsession "admingroupid",""
/ ?6 K' I, w) g7 g# ^
& f2 S3 u7 B) I" n2 r4 f2 B' esdcms.setcookie "adminid",""
% t. b% g- m% A" c  T% N
" L/ k  E$ s. B  Dsdcms.setcookie "loginkey",""
. A9 d& N/ a/ L# \0 [: G
9 o8 [) v% V/ e' dsdcms.setcookie "islogin",""
0 g0 j- n7 A. e6 n1 \
sdcms.go "login.asp"
3 o" k! L* s" h
7 k7 {/ `' O3 [" X% Yend sub

$ _& B9 p* e; C7 K
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
9 W- `" ~2 d2 s7 C修复方案：
9 m( a8 k( _" e修改函数！