SDCMS后台绕过直接进入漏洞

admin

要描述：
0 m, g% f) M9 q7 f3 Y, H4 C
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
. v  b8 ^$ s* E. W: P7 A4 L详细说明：
Islogin //判断登录的方法

( i5 x% q. k% z' I! xsub islogin()
. ?" k. R1 V( ]/ ]
# `/ G- M. ~, c4 h, ~if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

, L) i, k: G/ u$ j% n& I; }dim t0,t1,t2

) j( P; A3 F  m2 Zt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
  S" w2 x4 N! ?' E& q" ]8 {$ \
t1=sdcms.loadcookie("islogin")
0 a4 e  [+ @& n
t2=sdcms.loadcookie("loginkey")

, h) W+ v7 |- h! j5 rif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

( l5 s% n! y$ X+ {+ X1 |. K& }) i//

sdcms.go "login.asp?act=out"

; i1 E7 ?0 y- w% Kexit sub
& ^  }* F6 B' u4 V5 m' m
; Y' L) k' Q2 M6 \* ielse
0 b4 p$ Q% Y, I4 `" b- m# o
dim data
: o; I" g) s' g+ ?7 q  h+ m
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
" b' ^, c1 r' l% @* y8 u5 x% {
if ubound(data)<0 then
5 n7 f5 u7 p4 h$ D
+ y0 Z' y& R2 d3 H; D' X- Tsdcms.go "login.asp?act=out"

! J' ?/ _2 }: m% e! cexit sub

5 ~1 l' J* c' d6 E1 J, Jelse

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"

" @) Q! l. W& s' C9 Sexit sub
2 m* Z* D: y% r% L
else
  p) K& c/ w$ h% G
4 J- \" k( f/ g4 \' _5 z3 S' I0 S8 H% cadminid=data(0,0)
7 }: R9 |7 f5 y+ b% n% A
adminname=data(1,0)
" ?: l7 P1 E+ ^; u5 o/ E
" M" E) v9 ~  n; f. Qadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

3 L% ^" H2 i' Y2 ~4 r, }* iadmin_cate_lever=data(7,0)
3 ^. |. e, _3 \/ |. f/ h
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

$ M! t9 c3 p5 e1 H, ^/ w& b' ~if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
5 C9 `; e9 _7 p  N$ C
if clng(admingroupid)<>0 then
0 W8 `3 M: L7 E% l% ~
admin_lever_where=" and menuid in("&admin_page_lever&")"

; q' ~( Y: s7 Eend if

$ S: B, {% B7 `6 dsdcms.setsession "adminid",adminid
- i' T# A7 m9 H1 Y! R. }
* i4 x1 k3 w! Q8 Zsdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
' ~6 ^$ |  _- S3 G. x
- [; N- C: I( W8 _4 y  cend if

+ l9 c4 ~  v% lend if
, M0 T) }$ P1 I" g' G* R
end if

! _: l! _! c7 I* [else

. k5 ^6 b) P: S* m- Q. Z) ^data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
, h: k; l+ u9 Z3 q7 K
sdcms.go "login.asp?act=out"
/ w: B5 }; e$ u) a, z: I
exit sub

% i9 ]- g% U# o; k- lelse

5 f# b$ k/ C: F7 radmin_page_lever=data(0,0)

admin_cate_array=data(1,0)

4 q) c. }/ M, y& }admin_cate_lever=data(2,0)

- `+ V: `: f# B' G( x4 kif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
; S; k! z1 H: H8 @! }0 Q) g
6 ?( o) g8 A& _/ c5 [4 M& @if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
4 a; p  Y+ ^+ L4 q5 u
; x+ h- Y  y/ u( q8 M, I" {6 Rif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

( h' D) Z) X3 E7 Kend if

end if

  [6 `  H1 h8 G% h  ~end if

8 t" w/ {2 I  }# E- E. b' J0 Tend sub
漏洞证明：
看看操作COOKIE的函数
0 r# h( S! e0 j/ q2 C3 \
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

, L/ J9 X, ^5 x  ?4 I: ~" aend function

public sub setcookie(byval t0,byval t1)
( N7 I, _' Y4 Z5 R
response.cookies(prefix&t0)=t1
/ ]/ F$ u+ n  r4 R0 ^
end sub
. \. a8 l3 T/ c
prefix
7 ^% x" b- o5 N' x" y
( u' m% h5 `* k3 s* u( o$ I'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
' Z8 r2 J# J( R+ T% [9 @* X
dim prefix
6 [: G; A$ f4 D& q% G- p
. u3 J& _& \, v2 N' G; iprefix="1Jb8Ob"
5 K) T0 R2 a% Y- K  B
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
7 x& K( V0 j* Y2 F( F0 m3 _
2 u3 C% m6 Z4 F( m5 I* c$ ?sdcms.setsession "adminid",""
6 c- v" p* r8 i: m( u9 ]+ O
sdcms.setsession "adminname",""
& R( D* E- S% p
sdcms.setsession "admingroupid",""
! \3 x* d& K  t4 S' _
, Y4 m0 ^, v6 m7 S( a; X0 S' Ksdcms.setcookie "adminid",""

8 Y- k6 U8 ]& G  o. \3 u$ x" Lsdcms.setcookie "loginkey",""
$ R1 ?/ g7 G& S6 Q, J
sdcms.setcookie "islogin",""
9 t: v! u3 D# o
sdcms.go "login.asp"
* j& N0 E7 e" w* d- J
end sub

( c- O+ a; q) {4 b2 B& ?; h/ s# d
  p% Q. S$ h7 @7 s利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
3 I; X/ ]! t% u  Y7 A# o2 }修复方案：
. k) T( V, n; o% y: f2 G. r修改函数！