SDCMS后台绕过直接进入漏洞

admin

要描述：
3 L7 B9 H5 ~! v2 T. @  Z
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

sub islogin()
7 U+ S& ?' q+ W% l5 ~
% d; V$ |; P8 t% [2 C/ rif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
  X. A- s, L3 `: n8 f  N
8 |* E0 _7 @/ u* ^) h: d0 Hdim t0,t1,t2

* q3 I. ?  o! w; Nt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
7 `2 t6 `3 J+ G8 N
% T. Y2 B, l  X* ^. v# z! s3 S: ?t1=sdcms.loadcookie("islogin")

- W$ W- w* S: l+ K/ [t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

( o$ Q1 O, W+ z7 R//

sdcms.go "login.asp?act=out"
0 }& M, t) `4 F5 i+ u6 g
! A3 P1 v1 o3 ]  F# a9 C8 y; k4 wexit sub
; A0 }* K( N" h/ j  M* H
else

dim data

! ?* E2 q; |, Mdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
% v9 T8 H5 c1 I  Y0 J; Z
if ubound(data)<0 then

  v: y5 j( @0 T2 V2 N# Y5 ~sdcms.go "login.asp?act=out"
1 k4 R' O, J2 f  S1 e2 n- i
3 N; d/ Q7 m% r) @. k: |0 iexit sub
' S" k( b5 Z1 G2 q2 o5 C
else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
) e, J2 a" Q, `& U2 S& g/ f
& [( b2 v1 I5 W& Z9 z# ?( u6 Rsdcms.go "login.asp?act=out"
& Q2 l, e/ l2 G% l: b  ]. l/ Y$ ~8 C
exit sub
! l7 x  S6 R! }: J- L
' V& M  R* E  D" b& m& ?$ x" celse

adminid=data(0,0)

adminname=data(1,0)
8 d8 a! ~6 n( \) V. u5 a$ S
admin_page_lever=data(5,0)
1 s  H* p+ T' N9 P: V
- c' W' e/ D; J* C% U3 {" D9 kadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
3 \+ Q1 I& f& P* `) I% Z+ }, B" y# w* s
# ?' n* z$ u/ E+ k: {- ]if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
& T4 k6 J" E3 ^4 Y$ Z& n+ ~
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
- L8 S+ V) \6 N) D
if clng(admingroupid)<>0 then
- u' j- N2 X5 E& \3 ]" n& D
$ z# X& \2 F3 Tadmin_lever_where=" and menuid in("&admin_page_lever&")"
1 @) Z: Y- D* q* P$ \' q
end if
: V; K/ [" D* V% f0 {4 O8 y7 [
sdcms.setsession "adminid",adminid

" W" W% p" W( g; w6 e6 bsdcms.setsession "adminname",adminname

  ^2 F9 l3 a9 rsdcms.setsession "admingroupid",data(4,0)

end if

( U& Q6 p/ v/ ~- Rend if
" @/ z- a9 d& k1 k- \0 V- T$ m
) d+ E8 n6 _) E- h- vend if

  f& o5 o+ \# F0 celse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
( n. e! H* ^7 Q; U" w( Z& T4 a
sdcms.go "login.asp?act=out"
+ e8 r! @/ e- B6 }1 `+ A
# W3 v5 `7 {; U+ m, j/ t0 hexit sub

5 [- A8 u6 r/ ~! @$ P! gelse
: c' c" x" _, _" `9 b: i7 z
- i% ?# j/ M7 ~6 n& K# Z' Q+ madmin_page_lever=data(0,0)

admin_cate_array=data(1,0)
1 f, e7 w" o7 O) I# m
) `9 L0 n( C, x/ _% A- Tadmin_cate_lever=data(2,0)

) \( D7 i$ [# s1 a; I) E2 F) n$ Jif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
9 g6 ]8 G  j+ c
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
6 }5 l2 O  |2 x% V: ~9 x* X0 t
7 R" ]0 H- c5 P- H: uif clng(admingroupid)<>0 then
4 z  @  a% f3 V, E' M0 _
- l0 c$ C) U1 j+ [9 eadmin_lever_where=" and menuid in("&admin_page_lever&")"
0 e' ?4 ]( I- m+ {3 F
  L% x# i! ^4 ^. b4 nend if
3 @9 C( l% ^& S& x5 @
end if
! P; r7 @5 }; G$ f* ?
  {; r; D# @& u  K% oend if

end sub
漏洞证明：
3 R5 v7 F) a* q6 ^! h看看操作COOKIE的函数
6 J/ [* J" v; u+ g( _+ K
5 u) v' m4 k% W4 G( s" F( jpublic function loadcookie(t0)

6 A" S: [! Z4 S4 a  `) T9 nloadcookie=request.cookies(prefix&t0)
2 W2 i3 f% y3 W* Q
end function

# L# V& z) x$ s' Tpublic sub setcookie(byval t0,byval t1)
( |# z& l% d& ]# ^. w& x# ?
response.cookies(prefix&t0)=t1

end sub

9 ^# ^+ b( w# n1 C1 Yprefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

0 r( L  O. B6 r2 l1 b2 p# c) M5 Idim prefix
  z8 W1 D' m! H  \1 b/ A
prefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
3 B  Q4 w9 m! b3 V  P+ Y1 }
; M1 J8 y) T! S  s, Asub out
" c& I& V0 S7 w' g! n
sdcms.setsession "adminid",""
7 e) h9 i: C7 U& r# m2 z7 k! ^# Z3 c
) ~& W. V( \5 A( V3 x8 Qsdcms.setsession "adminname",""

: T; B8 k" P. O# B3 Isdcms.setsession "admingroupid",""
* c5 h) u) _; E$ r
sdcms.setcookie "adminid",""
4 `( \, g% a1 i& K1 S
2 N. c  E) U; O2 C# n  I% p* Msdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""
. h  p; N7 @7 M/ [  x* r
1 l1 |# L9 d7 c: wsdcms.go "login.asp"
$ x& ?4 v2 [. k& O1 u+ V2 x& q
end sub


; ]+ J, v2 i1 ~+ Y$ p2 {1 ^7 I利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！