SDCMS后台绕过直接进入漏洞

admin

要描述：
8 [4 ^% b9 W6 {4 }& g
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
! J, m) [5 ~! a详细说明：
Islogin //判断登录的方法

sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
( P; y& Q+ t9 x4 i$ @5 C) N. G# [
2 E) j- d2 `" ]dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

, Y2 R) T# b, X7 L' C/ V; d  u9 ~7 Ct1=sdcms.loadcookie("islogin")

6 k0 I  M1 u- |0 M) r3 ?t2=sdcms.loadcookie("loginkey")
& B4 _3 j) n6 _5 |: b, _8 g
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
- y1 M3 u2 D: |* g& b
% F6 q1 \# B: c) c: w2 @* K( V//
1 }2 h- N6 p! f* _) I1 i4 L0 l: d% L" Y
sdcms.go "login.asp?act=out"

: f* \1 d. m3 H6 j" |exit sub

else

1 O; F2 I3 q8 X: R2 Sdim data

: s/ L/ ^2 s8 z( ]data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
+ ?$ H: c) x7 H! j( J; t
if ubound(data)<0 then
% f& w& w* a$ s6 M6 L* [8 F; H
+ L9 |, I* D- ^* j- wsdcms.go "login.asp?act=out"

4 U  A% O+ n9 q/ D5 v5 {. Zexit sub

else
# U6 @* i1 O1 \  E
! w$ ?3 H: e; f/ s' }if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
- r# v; a0 i: E- |
sdcms.go "login.asp?act=out"

$ Y+ `& [" w( s' u& Vexit sub

* S, ~0 J/ k( B; P! Velse

adminid=data(0,0)
$ C9 Q, P7 X- p1 ]4 y
6 L4 X0 u4 W. n; G3 d- D& ^4 h+ `adminname=data(1,0)

5 K6 `( S  [* w7 e" K; V% cadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)
$ H" t- v" d2 c! V# ~+ q
  d4 |2 t! W# o9 j9 p. Jadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

( c+ c: v$ q2 b7 mif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
6 S! }. ^$ j) h: Z
8 ^$ N1 l* p! v9 X/ x. Aadmin_lever_where=" and menuid in("&admin_page_lever&")"
% u9 K$ y+ R4 W: {0 z! ]
end if

# ~9 y( Y* l. o: G+ Esdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
/ s' b3 W# x( I# F, ]: \2 x
end if
4 r# y% ]$ C( H) \9 a
end if
( L! ^. A5 z# g) K" |! I! V. N
end if
* N  S6 C; M" w. H& G; C
else

- c2 M- s. _  y0 }) R+ C- K! e$ |data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
" U& m5 W$ p! M
9 l" P3 s: r7 p( j; csdcms.go "login.asp?act=out"

exit sub

1 _9 P( a% h% V6 X, j" j1 H4 |else

admin_page_lever=data(0,0)
, y. b- \1 r1 j% P) i  f& o
+ ~. r5 u3 }- S; W; |admin_cate_array=data(1,0)

- F- ~8 u/ t3 c) P; ^; u  n9 yadmin_cate_lever=data(2,0)

8 c+ A' N3 O% J1 b6 ^0 ^if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

9 K) K3 M) K) W  Fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
8 W" z5 F) T2 _# J+ }1 C
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
* E/ T& u1 o; r2 n  @, e
if clng(admingroupid)<>0 then

+ Y0 g2 K6 \7 G4 hadmin_lever_where=" and menuid in("&admin_page_lever&")"
6 }  ?9 V/ B9 [" D8 u4 O' x4 F0 Q
* ^: X* @3 v& M+ h; b5 T- Zend if
# ^6 X$ ^4 L1 C7 [
& c9 {) A  r% C/ Q3 Z4 Send if
* w" y, E( X& C) v4 U- L4 m
8 W  U* n$ Y8 I0 B3 H* q0 r2 Fend if

, x6 d( w* c* a! \end sub
3 ?2 R) |$ ^! i# N5 O漏洞证明：
- t% ~0 B; x3 V; J- x& y/ D0 ~  M看看操作COOKIE的函数
7 g# [8 _- C8 s5 L# l( F* z
public function loadcookie(t0)
$ ]% d1 d1 Q6 R3 k# j
; U: V0 j2 V& M9 W- t. w1 e# Vloadcookie=request.cookies(prefix&t0)
. Q/ K2 N8 _/ i3 l8 d' t' r
, }1 m7 D. q- B- x0 Cend function

public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1

end sub

prefix

+ l# V6 T2 r4 G' ~" c'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
% L) u" p8 K/ {9 _/ g
' X; v& q/ k: C( ^- \3 _% w5 rdim prefix

prefix="1Jb8Ob"

. i5 s8 |/ R6 ^'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
" U5 p- A. J: h: Q
sub out
9 z# T$ e# Y- k
2 T. ]* [' S8 I1 n2 q: G8 Ksdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

* A+ a. Y& }2 s4 c6 isdcms.setcookie "adminid",""
* _, _  H% E2 r5 f4 b
sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""
6 }0 D" ~4 C8 d$ h* m
" k3 F/ B7 P/ b4 Q/ F/ rsdcms.go "login.asp"
/ x) R: X8 u! I
end sub
8 h* T" }( y+ ?  w$ g/ }) n# B
# I. _+ e8 @* I8 y+ q. o
  P6 {) B% n$ w1 d% @利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
( z* K7 Z% H# f7 S修复方案：
" h+ Z1 j1 P! l. s6 B0 n修改函数！
  ~4 Y3 W- ~  L, @  U7 }, O