SDCMS后台绕过直接进入漏洞

admin

要描述：

0 R! ]& \9 ^0 QSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
' z' m, y' X* b# r! L1 }详细说明：
' b. V" f! h( H2 L* I% w& AIslogin //判断登录的方法

sub islogin()

- P  C7 M& r7 W/ E+ lif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
( Q& i% w6 `5 `* g; J6 m
dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

2 A/ J# U' W+ H0 N" U2 Tt2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//
- b6 m" B/ C- C2 G& Z$ F  E
sdcms.go "login.asp?act=out"

6 y; h3 L' o0 Pexit sub

else

dim data

# F3 r" v9 m  R5 pdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
0 N9 L2 e8 L5 ]& M! V/ B( V
if ubound(data)<0 then
  {5 ]0 d. S6 a- q  v4 a( x" B- X$ W
  ~7 Q3 ?* W3 K$ q8 h6 Vsdcms.go "login.asp?act=out"
9 o* N! {+ _  J; I
+ e4 G3 I* I! M  Y* _" x+ J: Gexit sub

else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
  T3 i7 M0 P4 b  C3 b' {' h- V# `
$ Q, h( A4 ]0 Y1 K, J& o" h1 k/ Texit sub

else
1 g5 B( d" A# n/ W# [5 K/ B: x5 I
adminid=data(0,0)

adminname=data(1,0)

" V2 z0 q+ Q' @) Madmin_page_lever=data(5,0)

1 A& B% W+ G  B  \admin_cate_array=data(6,0)
8 x- ]1 A  o( W! \
admin_cate_lever=data(7,0)
  [7 `6 S! N2 D0 ^# J7 f2 s0 g$ r6 r1 q
) X8 u. w8 b. E. @( G9 j  Oif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
5 W) X9 S2 W3 i4 N* [
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

% d$ w3 y5 O8 g3 C9 o8 B) C- Pif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
+ Q2 y0 ?  ]! V3 h8 y
admin_lever_where=" and menuid in("&admin_page_lever&")"
4 Z- m5 R6 x2 L) T: c1 }4 r, @
end if
/ }% H+ f) H- r* d& W, _& C
sdcms.setsession "adminid",adminid
3 {9 K0 v+ x2 k& l" O
0 ?$ G5 J& M) g1 asdcms.setsession "adminname",adminname
1 [' A2 g5 b1 ^" ~3 Z% `
sdcms.setsession "admingroupid",data(4,0)
" s, s7 T( ?0 G9 @7 o
& C1 U, ]: f- Aend if
; Y" W" B- w( m; a2 d% \
7 z. g! d5 D! x. e, Y. kend if
* I' v* C; {0 W( F4 Q
% |- {. u8 s, N% \4 F( rend if
) x, S* |3 y2 e
else
: c; l* j9 r- `9 |* b
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

7 B  A) |4 }$ jif ubound(data)<0 then
- L% r, b0 s1 o! M+ C) S
sdcms.go "login.asp?act=out"

exit sub
2 d% S1 j. k8 ^- Z$ |1 V( V
else

admin_page_lever=data(0,0)

/ M: s+ w' m$ I6 v! H) z+ dadmin_cate_array=data(1,0)
; z0 Q( ^- ~! m' d2 p. B% i
3 G* k0 ]7 k, ?! x- t" n/ Xadmin_cate_lever=data(2,0)
$ @! c& s2 q6 B4 n! s
7 N4 r+ D4 b7 X9 i9 {5 G; b" ?0 Q& Zif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

' `! d% W! A, w0 Z7 r% Qif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

/ K3 `0 n: [0 r$ u+ f4 q2 qif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
- [# ?2 c$ }1 g5 P1 Q+ F9 c
7 Y3 O0 w- b$ O% w) Cadmin_lever_where=" and menuid in("&admin_page_lever&")"
: ]3 B. R+ q& E( T8 H' W
  O. H& P; J! U- Hend if
& l, }5 z& x% M7 M6 k) |) u3 [7 F
end if
; L  s( W/ ~: {! |
4 l/ T$ D+ b' ~" G# L4 Z# yend if

end sub
" I8 S" T6 @% q, N  J漏洞证明：
看看操作COOKIE的函数
3 d. H: a7 D9 y+ Q# N- Y
public function loadcookie(t0)
) p4 @7 W5 e  h6 q
2 f1 W$ W0 @! Zloadcookie=request.cookies(prefix&t0)

end function

% C9 a$ {( p/ m( qpublic sub setcookie(byval t0,byval t1)

2 O6 e/ D/ o  c0 W  Y& Kresponse.cookies(prefix&t0)=t1

end sub

  x2 [4 b& i9 y, K0 v/ tprefix
/ O5 G- `1 R5 O+ N( o3 ^. b
  e! }* x2 ]8 _3 ]4 r'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

& T' t# n4 o& @" N0 Udim prefix
2 V5 G* T" u8 |5 o
: S+ w: G9 p0 s: |9 j% nprefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

: [) w$ y5 @8 \; f* G* f7 csub out

5 E* A" s2 A* }& Q# y4 ?sdcms.setsession "adminid",""
9 S7 T0 E) [- ^( w: }
; R, G8 ]1 [0 ^6 {8 ?sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

: r% v# c6 O( c2 {3 Jsdcms.setcookie "adminid",""
  ~/ y1 r. t  A" f. W. d% r/ ]' X
( K  C6 R: R( t9 Y/ L- _% A  jsdcms.setcookie "loginkey",""
4 g, p1 e5 d, W5 g
: ?  D1 ?5 n1 R4 Gsdcms.setcookie "islogin",""

sdcms.go "login.asp"
* L# D: I: S8 f( n, j
! I8 {3 \7 G4 Tend sub
0 n! @$ G* g9 V! {
/ F  d" |4 H! h. w. D- d3 p
$ Q- M' O3 g; |5 f( E' N利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
: D( y, Z, m) I0 F0 m修复方案：
修改函数！