SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
- Q9 i) }, b6 Y, w2 W( X$ l详细说明：
Islogin //判断登录的方法

. |% s0 H' v5 [! b9 A- r5 psub islogin()
+ Q+ e8 k% ~7 o& g2 U2 ]
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
$ Q% w  |. d5 K' j5 @& [9 z7 A% E
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
7 M- H1 m2 \, L
6 m& a7 I1 s7 F# it1=sdcms.loadcookie("islogin")

( Q3 q& ?- F5 {7 \t2=sdcms.loadcookie("loginkey")

0 Y- G" Z( i3 O3 q% P' hif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//

% G7 P. A- T2 t& Ssdcms.go "login.asp?act=out"
9 A- m* O0 ^7 G8 m
exit sub
: h- N9 [+ m( u- v
else
: v( T! L, y& i
dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
4 |" d6 y% a( e7 t: ]
sdcms.go "login.asp?act=out"
; e4 m! T# [  L
exit sub

else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
6 U( Q4 R* H: C( {5 h! p
sdcms.go "login.asp?act=out"

exit sub
- |0 r$ c8 v, ?! g8 \2 W* {
else

+ I+ g, @1 o& L0 radminid=data(0,0)

adminname=data(1,0)
& \# u; n% `4 {' }
+ n* P1 q# Y# \1 cadmin_page_lever=data(5,0)

6 t7 p- O; g" ]3 I7 H+ P& S' Qadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

4 F& S# r; i. K1 \2 [if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
# B5 K  u* A$ C1 K' [4 v' ?
5 n( _/ a/ L3 V/ D. zif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
7 |: T- V) ]4 F3 z! O
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
( n# J9 S* p) I6 e( E
8 S4 v6 j0 ?/ k1 B  Bif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
' }/ t4 k( i) x
end if
: n7 `" g# G5 A4 r  s' O
sdcms.setsession "adminid",adminid
- q" R" H9 ]) [/ g/ J4 {5 M; G
8 c1 L+ V4 H$ u/ H+ }sdcms.setsession "adminname",adminname
. ~) i& R: k/ k( R" P
sdcms.setsession "admingroupid",data(4,0)

end if
5 s; n% V; x& d; D6 V* {
3 _) T% d6 M  D% wend if
# ?! y' `: m4 s* f3 f' a, r: [
end if
& n/ O) Q7 K# J& X8 d; t
else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

4 `* G" U8 V7 Y$ M, d% {  m2 Mif ubound(data)<0 then

sdcms.go "login.asp?act=out"

exit sub

; f5 d% R  R# G4 a+ uelse
! \$ v9 _( ?$ w3 u: N
" A: [7 M6 L* Z4 ^& kadmin_page_lever=data(0,0)

- N9 ^! }# j# e2 V( _. fadmin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

( G: N1 p' E& n8 e! Hif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

4 P) x' E1 W! G! I+ x0 F/ Fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

. d5 t) h  d, X2 Rif clng(admingroupid)<>0 then

- p* a8 x& e5 M$ aadmin_lever_where=" and menuid in("&admin_page_lever&")"

0 V9 N# L2 ^/ D' Q! _9 H: ~end if

* r, `. K2 o# \) m3 R' P6 Iend if

( p! n9 z% A! s$ q8 kend if
/ A5 d! O0 \) C5 s( t
end sub
漏洞证明：
看看操作COOKIE的函数

7 R0 n" @9 a6 wpublic function loadcookie(t0)
5 C2 ^3 x1 A) C3 v% I
) o; P4 ?, n/ j" N9 }# xloadcookie=request.cookies(prefix&t0)

end function

/ b& P! h8 O' S3 i- e7 ~1 Npublic sub setcookie(byval t0,byval t1)
4 _$ F1 ~5 W) g) ]8 }3 J
response.cookies(prefix&t0)=t1

* O9 V' e5 C7 Y9 a7 z" A0 _7 t+ Vend sub
2 v: _5 M' a% b+ P/ u2 o4 _6 X
prefix
' Z& S2 g( R( {" T/ s/ g
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
. F8 M; N7 y, V0 T% `0 C7 F
8 D. i8 S( T7 r% R, n$ H& ?dim prefix

5 I0 U0 I' \$ ?5 T4 mprefix="1Jb8Ob"
) Q# J+ [5 X* w7 o
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
- v% B5 b) p  m, u) y* s) j
sub out
* u/ t# P5 g. J
sdcms.setsession "adminid",""

; e+ P9 S8 i9 Lsdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""
$ t# ~1 [5 X' ]+ z0 ?$ ^
sdcms.setcookie "loginkey",""

! Y, b& S- }: y9 w  w8 g- r1 jsdcms.setcookie "islogin",""
3 T+ y% V8 }  |5 E; {
7 p4 q  k! P7 b' ysdcms.go "login.asp"

end sub
1 _! J9 L4 V; C) v/ K7 F1 j
$ \0 y1 A: D- j
$ T7 g2 u. m, E% h+ G9 L$ f利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
- r: R4 \2 `1 ?* H! L# B修复方案：
修改函数！
8 U( {7 ?0 `: r  q