SDCMS后台绕过直接进入漏洞

admin

要描述：

' R  Y  j) ]/ M9 y* x% WSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
8 u# H- C% [: r' y9 V$ Y* e* u
  C- P: e+ N$ [sub islogin()
5 A' Y6 [1 |" u% r) C# z$ {
4 @2 B4 e6 `) w! ^if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
9 |- r# h- U/ y. y# I2 A9 e' C
. h1 W% J8 _% N, Q3 k2 Wdim t0,t1,t2
( w" c$ l$ O4 s- L
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
1 S) Q5 j2 `8 n
1 ?2 g2 }" \$ d/ O, {! G* Q1 t% Ht1=sdcms.loadcookie("islogin")

( M9 ^* e! O' |8 G9 P, Gt2=sdcms.loadcookie("loginkey")
( {- X9 x5 Y4 A3 z
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//

sdcms.go "login.asp?act=out"
7 Q% S( ?: }7 S* f1 @8 M4 `5 h# G
exit sub

, ^1 ?! y0 P+ y1 Melse
+ |8 d7 U: a3 L2 [0 Q
0 o& j9 A3 G: @6 h4 h# z+ m/ q  _dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
  F- ?2 X* x) {* W+ ?
if ubound(data)<0 then

$ V% g9 X3 K6 I9 q  U; X8 rsdcms.go "login.asp?act=out"

9 C) F/ T' e- V/ [exit sub
: h+ ]6 v& R4 G( R
7 q8 m# E9 B3 f3 V# Z* F( ^5 ]+ kelse

& H% e" {' e" Q$ hif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

( @- Z3 d8 \& p, r6 o+ s6 v! `2 `sdcms.go "login.asp?act=out"

$ j6 y; z, ?( H% Aexit sub

else
! M1 S* {* d0 P" D! V9 E$ s
5 M4 \" u, T* |* N$ o7 {5 Wadminid=data(0,0)

adminname=data(1,0)

" M& Z# J7 i5 wadmin_page_lever=data(5,0)
$ s& s; k+ w3 I1 ?0 t' _5 g0 U+ A0 t
admin_cate_array=data(6,0)
. v1 c# G# p9 s3 I2 v
  ?# g' j" |/ l% p/ S" tadmin_cate_lever=data(7,0)

# E6 s* D& c8 z3 pif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
; C9 h! X' [9 ~7 f! h7 h: v
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
" U( I/ U6 X# {: O6 k1 G2 T
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
* q. ^: K8 j' w& Z" z' \
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
. V7 B6 s) B+ q) i0 [- g2 t
& w% g3 c( E2 r0 i% M2 ]1 Eend if
! @& t" U7 z$ ?& Q9 h+ R+ }* O3 }
' Z7 R) h; r% K" gsdcms.setsession "adminid",adminid

% q  g/ T' ~4 B+ u& Usdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
2 J( i6 T+ U- [# M* u5 h$ f- u
end if

end if
9 n1 f7 v& U( g8 e
0 G0 S& i4 }: A6 t* C2 Oend if

else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

: k4 N% [4 J$ T* c3 t8 I5 h0 asdcms.go "login.asp?act=out"

) `0 C3 s" a1 A( h+ z: I5 pexit sub

. G* p+ z) C  c/ K: m' Q* `else

- A$ z) ~$ [; V1 R2 @6 Padmin_page_lever=data(0,0)
! ^- A2 F# D9 ~7 L6 N" E! o
admin_cate_array=data(1,0)

/ ]# o' q. J3 D7 jadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

3 ^+ Y7 l9 R. g9 @; E/ _if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

2 L* a) e9 y0 I& S: i1 F! ~if clng(admingroupid)<>0 then
* ]: ?0 `, {) D5 C1 \' |
admin_lever_where=" and menuid in("&admin_page_lever&")"
. a; g/ d4 r2 Q0 ], p
4 H! }9 q. y4 ^  |  N9 p: Qend if
  b, l8 U8 l' Z8 r* c
end if

+ ]! E( G8 @3 `2 d4 P; B2 Rend if

end sub
: T0 k0 G. ]! m1 n3 W* i漏洞证明：
' T% [3 A6 I" X. S5 ^* e看看操作COOKIE的函数
% `: I8 D3 r% h. Q1 B8 T1 X  M
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
: F. u- x% c) J" U- q3 j- _! i# W4 q
! Y) O1 ?# d! k" }4 Vend function

public sub setcookie(byval t0,byval t1)

+ r- h( G% b0 Nresponse.cookies(prefix&t0)=t1

end sub
9 L/ r5 ?0 }1 r4 O& ?* ?. l
( a( M9 E1 x; @& Y: Aprefix
$ R9 o3 j( g5 ]& r; S5 T; y5 p
# a% z6 v* ^( D7 a7 Y7 V7 S4 T+ V% Y* Q5 Q7 j'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
9 }. @4 W0 E# v0 L. n$ y
dim prefix

% M( Z1 H1 h$ O3 T  N+ |4 o6 R# {prefix="1Jb8Ob"
7 K* E  x" F& x. z5 Q& Z, Y& e
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
6 Y8 [7 Z) C9 u. e) Y
sub out
3 d" U$ J- q' Q
/ H: l- g- `9 `8 Y, C1 h) Msdcms.setsession "adminid",""
  U$ c% j# ?: |6 p
sdcms.setsession "adminname",""
6 I* ]* J; Q1 i7 w' ^; D# X
sdcms.setsession "admingroupid",""

1 |1 N4 D- D$ |, tsdcms.setcookie "adminid",""

; Y0 c* X/ D( i4 y3 ]sdcms.setcookie "loginkey",""
/ t9 M+ U: a$ Z7 ^
5 r3 C/ O3 c' |3 H& k( W) {sdcms.setcookie "islogin",""

+ {8 U, V, }( ]3 O' ^' qsdcms.go "login.asp"

end sub
+ ?- L; i, `. j9 r3 c( d# f
3 f! V- M3 `) E, l3 O6 n( Y, p2 j4 ~
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
% ]7 _; o/ j0 H9 O修复方案：
' t* k" H- L6 r* {. b" G8 Z修改函数！