SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
5 P7 h& S2 z2 I9 }# F详细说明：
& {! ]0 Y! r* U3 Y3 \1 D' ]Islogin //判断登录的方法
4 F% k6 ?- ]) q4 b8 w& J9 x! S4 A
sub islogin()

& f& Z  u+ S- y, I4 P  t  p( E; k* Pif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

; o7 \0 X" {/ H4 P8 T) Q' ndim t0,t1,t2

$ _" c7 o- w9 _t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
7 m6 I9 ?3 c( E: W* R) Y8 q
t1=sdcms.loadcookie("islogin")
" _. x; A+ l) o: h$ E3 I
0 Q  n# c7 m! u! N9 ct2=sdcms.loadcookie("loginkey")
9 ~8 k# [  D" `; O7 Q
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//
+ q4 o1 v$ P; ^* w( `, }
sdcms.go "login.asp?act=out"

exit sub
7 D3 q# [8 z+ v* ^
else
/ D5 R& [/ v  _* \
dim data

* v/ v: |3 F4 e: r4 E/ b) k1 ydata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
# ]' [0 J% G1 k# j! l3 F
% s, p4 ^1 O/ C2 {if ubound(data)<0 then

sdcms.go "login.asp?act=out"
! A, P: D. X1 f5 t" k6 I# Z+ p
exit sub

else
  i8 n2 W: F6 P  f- }
. `8 s+ _5 L1 s& X  y( Kif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
0 r4 q# R, y1 x: M
  k( x, x+ o9 Q8 n+ T$ S5 D8 d9 msdcms.go "login.asp?act=out"
$ q3 H) M6 [8 Z4 z6 @5 m5 N) n2 i
6 E, \- e1 x  ]& e1 U) `exit sub

$ v+ |8 Q0 k+ ?8 Z4 [else
$ a5 a& _0 r" g: z% p
# U2 C( y; ^. |1 Gadminid=data(0,0)
: A3 {. D3 B: y/ i( m+ c
- A/ v3 N& Q6 m, h3 _7 |0 l8 c, \0 @adminname=data(1,0)

( f) p/ k$ c+ T$ `admin_page_lever=data(5,0)

- l. V' e. a" X6 Z9 K1 \+ R, q6 i7 `admin_cate_array=data(6,0)
# @/ V+ n  I: c6 V: ]0 F; M; j
/ H2 _4 \; L) R( r1 T/ badmin_cate_lever=data(7,0)

) P* x5 |; b) Y+ v# bif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
6 E3 \; i* t5 n3 O. T* e$ Y- {
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

) {" c$ h3 U4 _* f3 F  \end if

: M6 A* k, S/ H0 _# j" h- c/ i! dsdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
6 n9 f' ^; |' F. S" C( ]+ Y
# N- m3 u: v! D& ?5 U- B6 E; [end if
( e! \. ]1 P5 |7 v* R8 I5 V
( f3 J, X' j6 P2 e% bend if

end if
- i+ W+ r  h, d4 o' A
else

4 Y9 i, I! M' b" e+ J# xdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
1 i6 Z8 {8 u. P3 Q( ~6 F: F
if ubound(data)<0 then

8 g* L3 D) @3 @% u# a& Psdcms.go "login.asp?act=out"
  w4 r. V# B; s* K$ w' W* L
exit sub
3 w& A1 V8 r6 u/ A2 H; S
2 s  B7 V* a2 d; r, q  l# Oelse

& V$ K) r0 s& f. hadmin_page_lever=data(0,0)

6 C+ X' I: m; _9 padmin_cate_array=data(1,0)

8 T2 S# f; e3 V! e$ E& C0 zadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
! j6 a, B% ^; E1 ]
" ?) G. }4 @: `+ G' H6 s% Fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

- S' u& {+ T& T4 p- o& ]$ tif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
9 l8 C) f4 p7 E+ w! f% m
if clng(admingroupid)<>0 then

7 ~  D, |5 N0 P- S! ?; d' Q) k& b7 w( xadmin_lever_where=" and menuid in("&admin_page_lever&")"
! x5 h( z1 v3 V" _3 m+ U
end if

- u7 K8 L' v  M! I: V( cend if

9 Q- o7 H( }( h& K1 w( Eend if
  O' s; {) _  l( X2 ^2 L
end sub
漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)
4 [5 j& k/ V) y/ K/ a
loadcookie=request.cookies(prefix&t0)

" O- f; j6 ]8 {  Aend function

public sub setcookie(byval t0,byval t1)

0 j, h4 j$ e) \% Q4 A' r  C1 m# wresponse.cookies(prefix&t0)=t1
" K! Q6 j0 X% j
end sub
) _( g7 ~+ K$ e' y4 F7 Y
prefix

7 D8 V# B3 |/ k# v! _- _'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
$ P) f2 `' W3 h) |  W. W" A
$ g  h! r5 y9 Bdim prefix

prefix="1Jb8Ob"
* d* v" ~6 @4 V3 \; j" x
/ u/ Y* h* s  @'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
' l* w, y* I$ t6 J# t' R5 w1 q
9 z+ ~7 D; m3 O8 l; dsdcms.setsession "adminid",""

sdcms.setsession "adminname",""
) M2 ^- b& l: G
) g' k* Q) e$ y4 d8 \6 f' tsdcms.setsession "admingroupid",""

8 g. C+ ~% P: x9 ?* Esdcms.setcookie "adminid",""
7 ?" C$ k' p& f7 y! ?# l- V
sdcms.setcookie "loginkey",""
4 X. A1 p) B  f
sdcms.setcookie "islogin",""
' B- {7 b; L! T
sdcms.go "login.asp"

end sub
1 t( j8 k7 Z3 u5 H1 B2 @) o

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
4 I6 ]0 a) r  a4 x修改函数！
6 q8 s- r2 g0 `- t3 u