SDCMS后台绕过直接进入漏洞

admin

要描述：
. y# g; T4 w; A
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
2 L" S6 f2 f. JIslogin //判断登录的方法
. t+ J1 t! ]% @5 y" Y
sub islogin()

5 t, p! q- L1 y1 C, jif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
" \( n3 l2 \$ J
! H2 Q/ c- h. }5 Q: z- odim t0,t1,t2
4 m5 S2 A/ j% w" z# l
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
0 o8 d& O) y0 N$ R
. l$ `/ c2 B6 d; R( wt1=sdcms.loadcookie("islogin")
3 f2 d0 @5 s) `; e2 b5 y9 K: I6 d; U
8 W" m+ W0 l7 N' U8 ot2=sdcms.loadcookie("loginkey")

6 w5 c+ C$ V" s8 F# c; qif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//

sdcms.go "login.asp?act=out"

( g# w. E& j9 Sexit sub

0 I0 M4 L3 q3 }; Oelse
# ?7 g% f0 [: @+ d9 ?5 W& _
" G& r, b3 _1 Y. Idim data

( Z7 K( [  K5 ^- D( b" ndata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
+ M( |, d% ~/ b. L# V3 [
$ G5 B2 s" t7 o7 s, U- o. M$ T4 Z2 Uif ubound(data)<0 then

' I+ v' R$ g8 P( g0 wsdcms.go "login.asp?act=out"
5 J. q. h4 k! k2 _8 V) @
  J" K6 ~8 y1 ]5 t5 S( c' G5 I2 qexit sub
* Y4 Q; a6 ~2 U7 }# c) g5 z  }& K
else
6 E3 ?8 c1 \1 l. P2 }( b- v
! D6 ?8 d/ a, W- X7 g" a) I- Gif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
. L3 S. V" `  j/ _6 Y4 l% M# }
8 }' G0 Y8 k9 R, B" F0 y* X( isdcms.go "login.asp?act=out"
# e( V# i5 |9 G: n# Z& c
4 m7 i. G; `0 X: `% m: Y6 X# f& iexit sub

9 a" b3 P5 A& x  A/ ^* D: @5 U/ ?else
# k/ D- x: {3 g. w; @' y2 c* e
4 N# _7 m) I2 f1 Sadminid=data(0,0)
$ {' U3 n- W: A3 w  l! {! S/ t( P6 H3 l( [
7 Z* o9 X5 N2 _6 E6 Xadminname=data(1,0)
9 l. u1 T- K, C  `* C+ X; w# j  ^7 @
admin_page_lever=data(5,0)

9 _- M* z9 P7 t. T* x2 Vadmin_cate_array=data(6,0)

+ l, k& P2 F# I  ]  Yadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
% ?* n: K; U! P+ P
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
  S6 M" Q- q2 p) W5 \  Y
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
, b# F) |4 f8 e7 y1 L, l: j, V1 S, }
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
1 x; W% b% L8 m9 ^) D
end if
" |' J: U! ?/ e$ C" d
% w5 ?6 ^9 _9 H, o1 n2 Msdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

% J  n* [) k# O7 @1 A9 Nsdcms.setsession "admingroupid",data(4,0)
6 q& a9 [5 q2 ^
# I4 U2 s0 j6 Wend if
! P6 U/ i5 D  L, o' w
end if

end if
  _0 {6 @1 ?9 f$ {/ c
$ J8 V5 K. X" a; c0 s  }) Kelse

9 h2 ?6 w9 m' C& a: u, e! Ydata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

/ b. c! \/ }! l5 Xif ubound(data)<0 then
. Z8 r# a/ S  Q" T9 V! O
" e" o; W2 M. vsdcms.go "login.asp?act=out"
! F: k5 q/ R8 f7 y: X& o: O- p) w$ F
; i& G& p5 b/ Jexit sub
+ q2 R; r3 h: E# E+ i4 [
5 D# G% `! i& l. w' c- Felse
: Y8 x7 P! ^* y$ M
admin_page_lever=data(0,0)
7 A+ C) F* N3 p2 ?" K- }" K1 }7 y6 C1 A4 E
0 `$ o3 X7 g# q6 A4 Aadmin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
) K! r8 `3 C0 [, |! G! ^) @$ S( e' w
* l$ T+ e7 o# g' l6 kif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
: p! c5 R8 z: ?3 J) h( S+ c5 a
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
/ X1 J6 U& O; p) u) W8 ~+ W& z
0 J; _4 Q$ s6 `if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
- s- X8 j/ s  `, [( g
end if

% q! A9 T6 b& \) d) D2 [4 X( jend if
' J; V% M" U  Z6 p
end sub
9 y4 P' [2 e8 {; [2 u  L漏洞证明：
. L9 }# ]+ A# A) d看看操作COOKIE的函数

public function loadcookie(t0)
& g! ^' Q* O2 b0 `4 X5 Q
loadcookie=request.cookies(prefix&t0)
- u3 o$ S* B+ y3 u+ `5 G
$ x) ]( G, v% Q' f4 pend function

8 W* n! i1 v/ V" j  G( _0 |# Epublic sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1
0 ^8 g; q* E( E
! L5 O: `: j0 v9 i) u+ L, Y# i! Lend sub
8 i  Z" X* w$ a  i# z6 k3 C9 l* ~
prefix

% ]) a! w( F6 u. S* ]'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
' S% W0 i, r  i$ z1 |% X$ U; M( _
dim prefix

& L- b0 Y1 q/ o& s( a- S- O! kprefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

2 C8 h3 ~2 \; \8 v# Z" Lsub out

sdcms.setsession "adminid",""
$ V9 R% ^; [" g4 U' J- |' ~
- |6 V; B3 o* wsdcms.setsession "adminname",""

$ u# M5 y* M3 J5 {, C1 [# Jsdcms.setsession "admingroupid",""

2 Y# d6 e6 s7 V0 y# Ssdcms.setcookie "adminid",""

. ~, \8 r; b; P5 Y/ r' esdcms.setcookie "loginkey",""

0 w* n, N& Z6 b- ~) c1 r' T0 bsdcms.setcookie "islogin",""

sdcms.go "login.asp"
% I# R$ {6 {% T4 q+ Y
end sub
4 t$ p( y& R/ P. U0 c

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
8 j( F. s$ @* R" [$ W, H! |修改函数！