SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
/ J8 _, O& U7 ?8 ~! pIslogin //判断登录的方法

sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
. b1 [$ ^+ p0 k# c
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

4 r- W) r4 o3 Bt1=sdcms.loadcookie("islogin")
3 V# ]+ A5 t$ b; Q: {4 o* s
( I: }! I. E) m9 Yt2=sdcms.loadcookie("loginkey")
" G  t. q" H7 n  Z5 P
+ ]# [; s2 T: \3 E  O6 m7 Jif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

0 ?5 h1 k# ~, m, E. B//

, @( s- \- D& t; R0 tsdcms.go "login.asp?act=out"

2 G& p8 U+ _- i9 d) x4 Dexit sub

: z3 y0 X0 h5 X/ y- s1 i" y; ^else

" p1 K0 n; n% x( sdim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
: v! z6 \, Z" S7 D
0 @# r% g2 {- W2 W1 R' g9 @& Z6 E3 nif ubound(data)<0 then

sdcms.go "login.asp?act=out"

+ R8 ?" g* Q) n# I0 P8 b- j" ]exit sub

else

9 q4 S2 d- ^% E( e$ s9 dif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

3 ~% ]# D; E! L4 b% L4 q6 V' q. Psdcms.go "login.asp?act=out"
- f4 n: i# y. n8 }- s! ]$ \
3 F  V2 ?- v4 L  Qexit sub

else
7 E1 z3 e8 Z7 H9 ^: w" w0 _& {
% g# ~0 h/ E+ I  e) T9 \adminid=data(0,0)
( C* ]- u# j8 L# B% T
adminname=data(1,0)
" |  u; J5 J' \
1 b; Y3 ~0 e' padmin_page_lever=data(5,0)
7 X/ ^) ~: ?) S+ R
admin_cate_array=data(6,0)
  B: t4 g2 [9 x
admin_cate_lever=data(7,0)

3 I5 q- R- V, X( xif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

" p, n5 s9 `$ V5 t0 ^if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
3 ^* n2 s/ _; N: \6 \
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
) ~. J  _; X  Z* F) i7 d: H+ ~
if clng(admingroupid)<>0 then

8 ?1 o* k) u. e! b( ^" f9 radmin_lever_where=" and menuid in("&admin_page_lever&")"
3 Q, E" z; g9 B' L2 k; Y
end if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
+ [0 ^: q7 i- k0 ^% a8 X( c  Q
2 I8 S5 B/ P/ v# Y2 m3 ]sdcms.setsession "admingroupid",data(4,0)

end if
. p( T8 ^) N6 o0 i5 m0 @
end if
# q) q5 l  n& J+ d
5 F# M$ w. b/ L) Q0 |3 v' Uend if
/ A9 ~8 t$ x, x3 n$ l1 j- f9 c
' J; k' i1 \3 C8 Qelse
' C# }8 H6 o/ w' }% ]% o  Z
& c! C+ c& D2 P9 C1 X- |2 m6 {) \data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

4 _9 m  \3 t" l7 P0 N9 \6 Wsdcms.go "login.asp?act=out"

6 [2 V* B# A8 Dexit sub
3 s8 L4 b& c! J$ T
else

admin_page_lever=data(0,0)

  a& z, m; x4 B4 F' G3 S+ X, Jadmin_cate_array=data(1,0)

admin_cate_lever=data(2,0)
6 F; d  p) S" m! H0 V0 N/ F1 Z, @# h& @0 ?
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ }) v3 ^) L/ P( M
2 l4 v! N: v7 q. C2 z* fif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

4 i% H( C/ o  i: ~% jif clng(admingroupid)<>0 then
0 q6 J: T2 R. _$ s2 E$ [
admin_lever_where=" and menuid in("&admin_page_lever&")"

end if

end if

0 y8 b5 l  w. ?end if

' G: Q% Y8 Z* \end sub
漏洞证明：
看看操作COOKIE的函数

9 M/ H# y6 `% tpublic function loadcookie(t0)

. Y* z8 v) j: O( ?loadcookie=request.cookies(prefix&t0)
' B8 u6 p/ v8 {: ^) h! }) F  d
end function

public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1

end sub
5 f1 E3 C1 f! |. |$ s7 _5 Z, Y9 Q
prefix
- F( E/ ], j! f9 c
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

, W0 ]6 _1 e5 `) A; i: Jdim prefix
! c. c& Y  m% s: J6 V9 i
8 F- ]) S$ T) y# x4 U' A- `prefix="1Jb8Ob"
5 O: e; r! c3 }. S4 Z& G
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

6 F+ Y1 B0 Q- U2 D; g8 A/ Q3 X8 qsub out
0 `! ]0 X* c/ r' k- F/ G
% U/ u! [; r! I/ t2 m% j# ^sdcms.setsession "adminid",""
$ x' B2 j6 T8 E: C2 ]
" E6 f. K7 M8 hsdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

sdcms.go "login.asp"

5 @9 k8 L+ s! o3 fend sub

* ^+ p3 z! X+ O; F( w
2 k5 W  v9 b0 `) e# l利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
, N6 H# ]0 a$ j$ Q- w/ @% y修复方案：
修改函数！