SDCMS后台绕过直接进入漏洞

admin

要描述：

2 i6 ?- Y) ]. B# l  s$ {SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
; I6 L* n( f8 V! wIslogin //判断登录的方法

sub islogin()
" D+ A. A9 \( F5 O) v( b. T
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
( o: I( d: r  Z8 Q$ y" A7 K( U
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
2 `3 @, k* }8 a# e' l
: c& N) |! U* L6 D, xt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
- B7 M8 l3 o  a3 k5 e
" R1 l6 E$ A8 h: p7 |if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

! a: W+ a2 c( G' P( Z6 J//

sdcms.go "login.asp?act=out"
, W8 \. T% K/ k. u" Q
exit sub

else
9 {6 S3 A0 [# ?$ A* m# [
+ x; m6 @$ D/ J0 H- g" C5 ?dim data
- D1 y" S7 Q* r' |: h/ e* q% n# `
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

sdcms.go "login.asp?act=out"

9 T5 {$ Q  v1 F+ q( Z; ]exit sub
! T$ t! c- S9 t  l$ D. [4 d% o
  Y* F0 a9 H- {0 B0 U3 lelse

8 b( @( x( i$ ^* n: ~0 jif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

  v4 Y! T! a: m- _sdcms.go "login.asp?act=out"
! F- F  }$ q) |" l& Q
exit sub
3 \+ ]  O$ y" h4 l, _
3 z* m" t0 K  K0 b+ E8 D: c( \; |; }else
1 B4 R+ O! I& A0 f2 t
- `- V) p3 B: Kadminid=data(0,0)

adminname=data(1,0)

; m& u5 y" J6 O% z6 H2 g: m+ Sadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

, ]' p6 \$ e" k  a  T2 z& dadmin_cate_lever=data(7,0)

  R; [  m6 g; @8 X5 zif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
! a- z% Y/ |; b/ t
6 [- P; k, N3 T: ^, }if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
' Y  ~/ k- O; {7 I5 G
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
. i% o9 K$ v. K) ?# w2 \
8 o% k% n: ?6 u+ Oadmin_lever_where=" and menuid in("&admin_page_lever&")"
7 `4 _5 ?, w* K5 {
& {9 m" O8 V4 rend if

, Z+ u4 e4 M8 l; }; csdcms.setsession "adminid",adminid
$ Z  k$ B6 v: u- T! ^! b" a
5 Z2 {& c; M& ?5 ?* O# X5 ~sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
( n9 S7 }" @+ Y4 ]: \& {8 t+ E
* x$ r' O) W4 R. ]" b* k& w  |end if
5 ~( x; E( R) ?. m3 J3 X
end if
& g$ X/ J9 j! B# `4 r' ^
( b8 l/ \! P- D$ L8 b: }5 aend if
9 b8 Q$ J/ O! c. I. @
3 p5 P1 F% l/ r  \. B4 g3 P  g, E2 L( Yelse

) d9 z9 O: J8 p, O% f: `6 Hdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

sdcms.go "login.asp?act=out"

exit sub
% L# r* c" ^6 y* U$ m6 O
  k/ q6 E) Z: e$ o2 D7 \else

) z3 T+ x/ s& G  Yadmin_page_lever=data(0,0)
+ W& g5 {/ w% \* V( Y
, F3 ]; p* s1 S6 N$ Gadmin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

3 Q( ?4 V0 M/ g# J% d3 e9 T% B2 eif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 g! F. `' _! ~# }% g  k
3 A4 _2 @# M: p- @if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
7 x3 P# `# W* O
. u5 O0 l  }+ a' T' Q9 T' P/ B, bif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
3 S# l. q% D) e
admin_lever_where=" and menuid in("&admin_page_lever&")"
" K8 p# {% B3 x  Y
end if
9 G* k1 h) J; T) j7 U
end if

1 T) T  m7 E, v8 {3 Fend if
$ f5 v) |1 N. W( q" _* K( ?
+ M% j+ ^% }# D% O* |  G  r' oend sub
% Q9 z- V; n6 `8 \: [漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)
: l  E+ o! l* s6 g3 r) d0 r  W
loadcookie=request.cookies(prefix&t0)

end function
! @/ T) B) [- n* o4 i* E7 t3 j
public sub setcookie(byval t0,byval t1)

) H, ]. H+ v- Q; Qresponse.cookies(prefix&t0)=t1
2 l2 [; N2 C( E0 i. \5 N" B  j
* N3 b6 w: e- g% Q) T. j9 ?! [, zend sub
" T/ n7 [! s. q
prefix
- `) T% y+ r+ q% y
. r/ o% ?# I/ W'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
  e3 x5 V% I& t/ Y
# x& f3 L3 \9 P2 ]& m9 zdim prefix
" m) p- R, V% `- r5 C
prefix="1Jb8Ob"
! _+ |4 Y3 k% v: I5 B( |* A: E) |& \
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
5 u1 Q7 b3 V1 p
8 f+ l7 t9 x$ s3 Jsub out

5 d( [" T0 W( T6 Z0 h. Osdcms.setsession "adminid",""
( H9 _; S, G4 O; J) p
, x6 ^7 Q- _) Z/ |sdcms.setsession "adminname",""

) k, u) S: r  o+ p  D9 lsdcms.setsession "admingroupid",""
: l) l# f: y% \7 p" q
sdcms.setcookie "adminid",""

( V0 E7 I) ~2 M) h( qsdcms.setcookie "loginkey",""
; V2 _/ W& g4 j8 f6 r* `
sdcms.setcookie "islogin",""

+ f8 z3 C8 \' `* g# Msdcms.go "login.asp"
' v: Q5 i: |4 G7 {, c$ }
end sub

7 J. \# y- M0 y1 A3 f$ c
; Z8 r; ]% }0 P( t% e& f. o5 c. S利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
0 A" u; J6 f1 `$ c4 n% O# ?修复方案：
  B% x+ O( `- Z5 @修改函数！