SDCMS后台绕过直接进入漏洞

admin

要描述：

  Q6 ~0 G9 b6 _0 |! x) M0 G+ @5 cSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
0 i4 a: z3 q6 v! h2 [0 [详细说明：
1 ]) B: j* R0 S+ E# F, r- EIslogin //判断登录的方法
) t# z3 I1 @( F7 t0 m* h
sub islogin()
. r9 q* z3 E. ^0 a7 C
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
2 Y  ?/ [" [* D) {) J- v
) h* ]; @) L4 x% H1 b% `) vdim t0,t1,t2
3 T' {: C9 j/ }: @2 R7 T
2 |# x3 _8 r! P9 P" zt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
2 W5 B' E5 x. D- T) }4 R% O
' ^6 Q) }/ b: _' i( h' m+ qt1=sdcms.loadcookie("islogin")
6 \* b' f' k9 e& g* D$ q/ V; l
t2=sdcms.loadcookie("loginkey")

6 H% d: x5 a. w4 k+ k6 }* f  P* Xif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
' T- ?9 T9 l, b) l9 U
//

+ r& w- ?; D9 e: O) ssdcms.go "login.asp?act=out"

2 M5 y7 S# D/ ?8 b: l2 iexit sub
" W( n7 |( |  T$ g/ d( e
else

/ r( C3 ], V* hdim data

& q& \9 E1 S( N: Y$ c1 e0 X  ]data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

sdcms.go "login.asp?act=out"
+ }: O! v0 Q: L  w3 ]
- Z7 |1 Y- m' U/ ^0 z2 o+ ]exit sub

* A$ y/ T4 C7 s. qelse
% R2 x8 M; U9 D
3 G" |5 m4 {+ ]! ]6 Y( {if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
* A6 f. q; [* K2 @$ ~
exit sub

else
  g% U/ a. h5 _
adminid=data(0,0)
4 S* B8 s' }- g: z
adminname=data(1,0)

admin_page_lever=data(5,0)

5 ~' }& p2 z; D) k" g: I+ |admin_cate_array=data(6,0)

! ^; E  `) P0 m) ?: j; Iadmin_cate_lever=data(7,0)
6 n- w* w7 @% M5 {. E
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
  L, M* T7 E# D/ j
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# y9 Z2 Y- i/ ?. [8 ]
) Z5 `" l$ ~( T, m) a8 Bif clng(admingroupid)<>0 then
0 o) u2 W! U3 K; ^. B/ U
7 s/ K- j* D$ ?  [. X! e& O4 B4 ~admin_lever_where=" and menuid in("&admin_page_lever&")"

  L* B9 K2 j# k; O; V( pend if

: N8 K% v7 `8 [; U$ h$ gsdcms.setsession "adminid",adminid
9 n7 {8 e6 \" f: A
8 d# ?3 O. a* @4 Csdcms.setsession "adminname",adminname
3 W# j, [! K/ u
sdcms.setsession "admingroupid",data(4,0)

end if
! J  q/ M1 S, M& c
" s5 Q  r' h" {# X+ x7 qend if

end if

else
' {% L+ t% y8 z1 ^% a) `' }+ D
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
" ?/ A+ K% X( n4 X* }  \
( Z5 W4 P5 c2 e/ Lif ubound(data)<0 then

6 p  Z8 c  c6 w1 N. C: vsdcms.go "login.asp?act=out"

$ V$ N: u! u% Z5 p! g! M) ?+ texit sub
9 \0 r2 Q0 Y/ P! E1 E
else
- @- h3 b0 \/ ~0 c/ y
admin_page_lever=data(0,0)
) K6 B7 A  h( e1 `% Z9 `0 i5 ?
  I! I3 |. A# B# i6 m5 ~4 ]admin_cate_array=data(1,0)
# R2 y' t- m- p3 o
, x1 y) A! z1 G4 t# |/ [" qadmin_cate_lever=data(2,0)

9 `( i& E; k, aif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
1 U& H* O# f/ z/ E4 G; `5 D6 H
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
* q0 E# r3 i! {6 E& @$ X8 i% V$ ~
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
; G( F+ v6 I4 l$ L
. g5 y3 s' j  }+ y3 a: d: nif clng(admingroupid)<>0 then
" o4 N0 L4 [( j& }, p
admin_lever_where=" and menuid in("&admin_page_lever&")"
$ K* i  u3 v9 S5 s  `! i" [; W
; N, w) u$ k& uend if
! M, `& @) s7 z3 q6 g1 D  U" z" ~
end if

* v9 S  t) s  u  I" o2 send if

end sub
1 w" Q3 }6 g' c( B, l9 R% s/ o! h1 P漏洞证明：
1 s0 i1 {, W& p看看操作COOKIE的函数

/ d7 `5 @' m/ s2 Lpublic function loadcookie(t0)
0 f2 l0 V8 W- U7 {/ \. Y# H
) `$ v* ]# e: q) L! N6 R6 D! c/ Jloadcookie=request.cookies(prefix&t0)
) ?+ t  ?2 i8 u' x
3 L) _  ], P- n6 i& @end function
; q) k9 L6 \) S
public sub setcookie(byval t0,byval t1)

, g9 Q  G- K- D  v  hresponse.cookies(prefix&t0)=t1
/ \4 j* s8 A) C0 q
end sub

- ^! g. n  U! k- Sprefix

  _- l9 E$ S/ L/ b- ]5 o'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
; U* D0 F" @# a3 G' Z$ b6 @6 l5 f
+ O% ]2 q; X- Ndim prefix

* j( X) N: E$ w0 |3 i0 Kprefix="1Jb8Ob"
& d' ^3 d1 m* c! [
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
9 w) H+ L1 v6 M7 d. \
sub out

sdcms.setsession "adminid",""
/ m- }6 e8 a/ _. n5 b
sdcms.setsession "adminname",""
9 w& j& v8 Y. ?
sdcms.setsession "admingroupid",""
9 c  ~2 ~  \8 p6 Y/ U* \6 }. b
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
4 S3 o8 c4 z4 m
8 d# [+ [9 c  |sdcms.setcookie "islogin",""

sdcms.go "login.asp"
& r) K5 {" b4 ?- P# S# y' v9 _* s$ z
end sub


3 E8 [) ^. l# S9 C  x; Q2 U7 c+ q利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
* x1 o0 q) T$ u7 M" z' ^修复方案：
: _" I  p/ N* ^修改函数！