SDCMS后台绕过直接进入漏洞

admin

要描述：

3 s' _6 d6 d# U0 ^. A% h2 e1 KSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
' u2 g9 q/ T$ x  [2 k, ~, J详细说明：
Islogin //判断登录的方法

sub islogin()
: I; d0 j. D( y
2 [8 z; b1 M, O  q$ xif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
+ |) w0 y9 {7 K. h2 y  R
: d! J7 @: h/ H9 Mt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
7 C% g* m1 B1 E5 r
9 T8 z" [& C6 t6 G. Y; v: pt1=sdcms.loadcookie("islogin")
6 A. l7 y# r( `# h& E6 C' B
t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
# z' ^' l* ^1 ^1 a
' v5 o+ @' O" p, F, P& A//

sdcms.go "login.asp?act=out"
6 P: L. t1 P) h5 |6 v
exit sub
5 U3 x7 V- O  [0 U
else
# B, J8 A7 z6 h
dim data
: U9 @( D5 x  j# o) j* T
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
& L- i' C8 Y& J( y
5 S5 R. h1 I, m+ `sdcms.go "login.asp?act=out"

exit sub

% U% V5 d, _) ^9 `% n% Belse

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
# T" j5 k6 c8 s" }1 Y! C1 T& p
sdcms.go "login.asp?act=out"
9 F. X( x' c6 J% t7 u( {5 X, Q7 u
exit sub

4 F8 ?* }! z0 {  w8 c+ Telse
! w2 K+ H" y. t7 P3 J" N6 N
adminid=data(0,0)
: O+ Y8 P4 @- o  b8 p2 A: W
; @: C% I/ A) B4 h. S7 badminname=data(1,0)
4 e( E" R  D0 ~1 k# D/ {) u
admin_page_lever=data(5,0)
7 u/ u) X6 p* i
admin_cate_array=data(6,0)
2 [  l2 J) _* D5 p$ ?! L
2 P3 x! N7 u6 N8 _$ oadmin_cate_lever=data(7,0)
; D$ t0 ^8 |. l$ z' x" n
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
2 }( _3 H) t2 h4 e+ E% P- c
7 Q/ h( C. k3 ~if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
$ ^4 }2 c% J. F' A3 M7 \" T
8 |# q, W2 V2 n# q. o/ X! V1 a- Aif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
) y0 a" Y& \  @) {
" F6 K' ^9 v+ f/ wadmin_lever_where=" and menuid in("&admin_page_lever&")"
, E* {, ^4 _, P3 a6 s2 Q3 e
9 E5 I  }( G6 Hend if

sdcms.setsession "adminid",adminid
7 m# Z6 g5 G- y: X$ E; p
9 o8 D  }3 G8 w* U  @& I6 zsdcms.setsession "adminname",adminname
- h# e7 t# W+ X3 k
sdcms.setsession "admingroupid",data(4,0)

end if
6 A& f6 }' K' z
end if
  L6 j! }5 q# y* a* s
# }# x7 ]0 \; X0 e5 v! Rend if
/ q, f! k5 A) V1 o. B8 ]
else
" n8 p+ r8 |/ b, p
# W% B8 h6 M7 G" \data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
+ Z. r! D) s  W; X' }
+ r! Y  `* O4 G+ b/ Y+ d, Dif ubound(data)<0 then
, U; J* c* I4 m. L. A
$ u1 v  V2 \9 |sdcms.go "login.asp?act=out"

exit sub
9 [/ W0 z' t% l* u4 e! @
0 S! t4 m. Q5 w/ N, f. Celse

admin_page_lever=data(0,0)

3 A  ]7 j# ~- C' H% ladmin_cate_array=data(1,0)

, F( x$ V* K% `9 w! z, |3 ~! z  J8 c% gadmin_cate_lever=data(2,0)
9 D* ]2 N' ]; |4 A
$ j7 _, e: V4 s! ]if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
$ y. ^1 B6 a1 V9 N, P% U
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

, J: W, Z" |& W+ `' Rif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

& [( k/ i# H2 r6 S, eend if

0 a, o9 d$ {6 s8 S& m: Yend if

+ M- N4 d- Z  M( ]end if

end sub
9 V/ u4 A) }2 y5 E  u- r漏洞证明：
看看操作COOKIE的函数

! L* u: O3 |8 c# cpublic function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
4 g4 m# h8 X: ~" ]5 d% Z) }
  x& [- F. k) Qend function

) Y; I- `* D4 e8 E  k7 @# _5 Ppublic sub setcookie(byval t0,byval t1)
1 |0 l; j6 Q4 |7 b* ?
2 B1 R. s" E! F3 [: ]  }response.cookies(prefix&t0)=t1
- b4 b2 H1 l6 P$ y2 a+ K
end sub
8 U. v9 M8 p0 {! G( b6 o
" w# r3 x8 S( Z4 R% M/ |2 }prefix
( [: p7 E+ ^0 J7 N
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

  c) C) q! i, S0 w8 t$ Vdim prefix

* t3 ^- r! N9 k7 K. aprefix="1Jb8Ob"
% T/ x: B/ d% ]! P5 v  u' a
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

, k8 t. `3 n# T2 O9 z: m' Jsub out
" J  a$ V9 C: \$ C' W: {) k
sdcms.setsession "adminid",""
+ x! N$ I) A" c- A
8 w* L# a  T" z% a" |sdcms.setsession "adminname",""

  s+ k. N% V0 [% U8 R* j9 Lsdcms.setsession "admingroupid",""
+ r. x  R+ t* Z$ h6 l
0 T5 F1 j( Y% Gsdcms.setcookie "adminid",""
8 |" x* s3 @0 {7 B
sdcms.setcookie "loginkey",""
$ G* B# N2 n* h/ u
# z! A) o  q% b1 m6 Vsdcms.setcookie "islogin",""

sdcms.go "login.asp"

& N' E( w0 v6 G6 r, }) S& yend sub
9 Z, i: @1 J8 z9 h
  M, z# y. [3 e( V% g/ M& Q
% n2 P2 }( h( a6 U利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
% g3 g9 x! G' Q" l; _+ L' V+ c修改函数！