SDCMS后台绕过直接进入漏洞

admin

要描述：
% h8 ~; w' N, d6 S* U8 T1 i5 ~
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
- u$ ^; o/ X) [" ^# V8 u* A详细说明：
Islogin //判断登录的方法
( s" ]4 c3 G" |  y4 ^, y
sub islogin()
/ [8 i* |3 x% P9 A, I/ ]5 A5 x
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
& L6 e3 }8 p/ l  d
dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
2 A1 E8 ?5 ^! f. s1 u6 h
1 T% K9 _/ f7 a6 H9 pt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
, \3 {; x: K% D+ E( o# n
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

# S' H# @& ?2 K/ @//

7 ^) m( g& ?2 \1 Lsdcms.go "login.asp?act=out"
! Z2 H2 {7 R" G# i" ?6 a& l
exit sub

else

dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

- j6 Q" w2 `# D9 w: Qif ubound(data)<0 then

& x" D4 {+ K1 {9 |* m+ ^( Vsdcms.go "login.asp?act=out"
( J& x; E" l7 P9 G% d- G1 a
exit sub

else
- x) m6 C8 F) t6 S- P4 `
% C: E  {4 T2 r$ Qif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
. G; R9 p0 ]2 h7 y1 s9 q
! D* w: N7 D+ H7 q- V8 b( D9 osdcms.go "login.asp?act=out"

exit sub

3 B% ?0 a4 G) g0 melse
- v; G! h) y% U: y/ R- ]" |
2 t: J8 y( S4 Y% W5 Madminid=data(0,0)

( r3 f7 H- I8 V9 |; ^adminname=data(1,0)

admin_page_lever=data(5,0)
  [1 S+ a  r& {, r3 x" \0 _8 h0 j/ H
admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)
/ |7 K8 t% C, {4 z
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
$ v, n2 t3 W  k% ^* @/ o
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

7 @* b* R# u8 m0 I; a% n; u+ r. Zif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
3 h" u& D2 B; _8 O
if clng(admingroupid)<>0 then
; F$ j- W9 L/ o5 ^# w. n
0 K. [- `/ T" G# M' y) i# o# uadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

( T% |/ ^; h0 s* nsdcms.setsession "admingroupid",data(4,0)

  V2 L; x# N" q, g8 _end if

) ~; T& B' q, K( [& Dend if

; N" {4 ?/ @0 m% N/ G2 oend if
- p* M& B& {; [4 ^# S% ^
& o1 e! {6 t3 q6 C4 \else

, }3 T* e' q. B9 q9 x6 ndata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

5 L- j( }& f3 o3 X/ h5 b8 @if ubound(data)<0 then

sdcms.go "login.asp?act=out"

exit sub

- V; B! G" D/ E+ y' g, _  w& A9 uelse
  L% Y% }  Z& |" ~6 m" @& }
admin_page_lever=data(0,0)

; u$ ^% f: Y. n/ l; M. Radmin_cate_array=data(1,0)

$ Q9 t9 `+ L: I; i4 Tadmin_cate_lever=data(2,0)

- }9 T' y. F& F: R# b0 bif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

! g& L5 x6 u0 J$ l  U6 |if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
& d) {3 |6 ~- `% F: h# B" G1 x
if clng(admingroupid)<>0 then
1 R* n9 M  r5 g
# E, g/ }9 m# F; H+ \, o, Eadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

% y, A& T7 O9 {' O, p. Send if
* ~$ a) ~6 J2 M" m& U* Y
; Z$ _9 t& H. N$ ]0 ~( qend if
" c6 o4 D# P1 r! x
end sub
漏洞证明：
4 K% z1 a5 G' D+ V) `( t看看操作COOKIE的函数
: n# x3 C# S$ A1 a  N* A4 m
# B3 b0 A4 `4 Z* o' Epublic function loadcookie(t0)

+ V" ]3 S! f+ mloadcookie=request.cookies(prefix&t0)
3 o6 e  L# y! B. E$ g  V+ j
' X# M: t( Y$ D. C! ]5 qend function

public sub setcookie(byval t0,byval t1)
- N2 m$ ]5 ?+ q, j' b6 V& x
response.cookies(prefix&t0)=t1
* |; x! _7 T$ @5 m7 N
end sub

prefix
- T6 ]+ b' b: a* g& ?, h! k
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
: k3 x5 J4 o& ]
( n0 B( W, o0 _, d& B2 [dim prefix
& G* |; ?/ z2 n
prefix="1Jb8Ob"
- ^: b  r1 h* }  d# N4 c) G
& N4 s3 M$ J6 M  m, [( ?; ~'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
* {; `2 m3 w5 q$ l5 t+ Q
sub out

( V! |. h7 s. t" x' \0 d) Lsdcms.setsession "adminid",""

& |7 F9 b$ t) z* k6 o( |. o9 Osdcms.setsession "adminname",""
/ J( p) z* ^8 w" o* ^- l/ _
sdcms.setsession "admingroupid",""
3 `; ]- `0 E1 q- _9 h
' I4 F; X) w6 ^  _/ a# M% a1 asdcms.setcookie "adminid",""

* T8 W: {1 H5 w! Y+ c+ psdcms.setcookie "loginkey",""

' M! V+ x( P+ Y! `( Y( B; rsdcms.setcookie "islogin",""

+ {! m! r7 @0 \# tsdcms.go "login.asp"
6 o' q$ q- w  T
end sub
* L: a$ _; d- H! ^4 s) V3 A
0 x5 z/ E; }4 e: T1 @4 u
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
1 P7 D! `. [: m) ]修复方案：
/ K1 [  v+ v. T3 a9 x* i修改函数！