SDCMS后台绕过直接进入漏洞

admin

要描述：
( s& b6 E# y0 ~7 {7 J) g3 R" L
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
* ^$ |0 h- E# z详细说明：
. f' A" Y2 I8 x/ u: }5 ~Islogin //判断登录的方法

$ q$ ^  Z* i! O& ?% C5 vsub islogin()
& M0 o% c  K  h: ]" u
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

9 K7 O3 Z& C* Z! M. ^3 K: C  tdim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
; I6 L9 Y1 ?  `4 a
2 g0 w+ _- M8 T# Kt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

1 [) L, }. T# d* Z6 S6 l$ i4 qif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
9 {8 z# ^  {+ A; L
//
2 R  X) o  L9 H- B. Q& X
. s+ k! O9 P& k$ O8 k2 fsdcms.go "login.asp?act=out"
' E4 P# y$ }9 x2 u
8 C# s$ M% E, K/ {exit sub

) T; U) v" w( S: O1 Ielse

9 N# j' ~; D" K* B; d$ adim data

* H, x% s' C( v" |# F' ydata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

$ k  ~) \2 \) Z! L$ Xif ubound(data)<0 then
& C2 E) W1 g3 D4 p) A4 x" k
sdcms.go "login.asp?act=out"
7 T, z( n0 x+ o* Z# j7 P) t
3 @3 m+ U$ m: Hexit sub
, h8 O8 ^  m7 x2 y  t) `4 r
8 r* e# S0 I: i2 B' A8 ielse

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

2 b- o) k7 l# X, c( f6 ]9 Z* Nsdcms.go "login.asp?act=out"

exit sub
4 V+ N+ a/ J! L1 z1 c7 p, e
else
! M8 [# m) A. j4 H5 S
adminid=data(0,0)
5 I4 G( y, A  v3 _# X
& \% L$ h0 j+ o. q7 Z8 R9 `adminname=data(1,0)

7 p8 A1 y* _& M1 ?3 m9 _2 ~admin_page_lever=data(5,0)
0 |$ U- ^8 Z3 r0 C
& O( T8 i& w& m" I. vadmin_cate_array=data(6,0)
$ v* v+ G; o2 e# n
admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
! t% a. Y) l+ O+ ]5 h& a+ n' X. x
3 C2 k7 w* x; S$ U* kif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
; ]5 p4 {( P: P; ?
admin_lever_where=" and menuid in("&admin_page_lever&")"
8 n0 ^7 @2 Q7 b2 Z
end if
4 w$ M6 P% I, E& d
1 B+ Y9 a+ P) [) vsdcms.setsession "adminid",adminid
  P% g- E! j2 i' u( U
sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)

end if
1 F  k3 @8 ^( H" k) u$ }
: P4 w1 w, C/ [% I2 \5 b# Fend if

3 x. E! t9 U5 `end if

else
! Z0 N  g6 q5 Q8 U$ y& {
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

) ~( G  y% x' T( |' Pif ubound(data)<0 then
) P# d' [0 b$ P* v
sdcms.go "login.asp?act=out"

exit sub

else

' N" u' ?0 L) Iadmin_page_lever=data(0,0)
4 {- c# Y; W  g7 B. z! K1 T# x
admin_cate_array=data(1,0)

/ i" l: x0 H) P! y- |  c$ }admin_cate_lever=data(2,0)
6 H" l7 a7 X0 _
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

2 E3 G" V6 E. w: c  V, a: P+ hif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
* }+ K+ L0 m5 j3 O. V- A; a
3 t2 `2 W- |- Q% U0 t$ mif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
2 y6 g/ Q) F3 w
if clng(admingroupid)<>0 then
4 Q+ d1 h8 Q8 t1 c9 O
admin_lever_where=" and menuid in("&admin_page_lever&")"

/ Z; m+ y) \" t* x3 X3 wend if

end if

7 t; m# V: L9 b5 @, ?4 i( U) @end if
4 K) T6 V7 r! B5 S) A* o
! G" G0 I* j9 q8 Q) f7 D7 R5 C- Gend sub
漏洞证明：
看看操作COOKIE的函数
" r; Z, P! T+ _
2 [% C' d2 N( ^: `) w: H- ?public function loadcookie(t0)
* s# w( E4 `) P3 T
loadcookie=request.cookies(prefix&t0)

end function
% W) }: M# s* T) t, F3 u4 W6 F
- C) K! `' |( h+ N5 n4 h7 y/ G7 Spublic sub setcookie(byval t0,byval t1)
' o, o+ }* V* u5 H% t. |* u, g* b0 [2 N
5 w# X% _4 b* m2 |4 x5 Sresponse.cookies(prefix&t0)=t1

5 V; \  \" X% a+ ?: Rend sub
1 [1 G! @% R+ x7 J; }- E
6 u6 n9 m/ L# E- Uprefix
+ V9 d# @1 @1 C0 g6 d8 ?
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

2 B) ^6 f$ x0 s% _5 Odim prefix

  {! d% V2 z; w' K; W5 w2 Aprefix="1Jb8Ob"

. |' E/ Q) B  s'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
4 Y5 @7 `5 N3 R4 B
8 \* F( ^+ S# I, k6 D/ z. Vsub out
6 D: t) \5 _3 M, T  v
sdcms.setsession "adminid",""
$ F2 ]2 |% y& |- g# t1 M7 m
sdcms.setsession "adminname",""
4 s1 e5 T: F0 ~4 X. ^
+ k) Z0 i) Q% Q2 |/ i! U  Ksdcms.setsession "admingroupid",""

* J: _0 Z, F+ f* L+ vsdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

: a- I5 R: m5 u$ g- F- }sdcms.go "login.asp"
, Z* g1 p; M. V- o
end sub


+ k# ~- D+ m" o& V3 Z* ]利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！