SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

sub islogin()
& `6 W& V  M: x* s$ g% q
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

1 z5 x( F2 }; pdim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
9 P' x8 N2 x/ a! t* I$ _% x9 W
t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
9 `6 G& K6 ?9 S% ], j" g
2 Q$ H' A1 `( r  r% ?$ b- rif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

4 H) B! k. r: h' W//

7 z" t3 I' y/ g, Z0 N+ R0 xsdcms.go "login.asp?act=out"
( |" \( W6 ?5 z. a/ q- m" _- X
, g" D2 ^! H" K! C( T5 ^exit sub

else
7 ?' _! j9 \; @6 J& v5 m3 k; y
dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
) ^9 E) d5 ~# D
sdcms.go "login.asp?act=out"
/ |7 L8 f9 d* i- l, u' |+ q: G6 {
# G* Y4 E5 q, h4 L4 qexit sub
! C( t( x- T3 g: P# R3 _
else
$ \" k, N1 `0 V% Y
4 R8 q4 X  Y, C( ^! T+ Fif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

* R. o- r' V( k/ g; s% s9 Usdcms.go "login.asp?act=out"
  I, A& a# P. _) ]1 p! p
exit sub

7 i! m( K! v' J! q8 ~  k: aelse
  B% {( f$ B4 p8 `
% n% }+ ^% [" a4 |6 V( I" [adminid=data(0,0)

* b4 k8 w+ [* padminname=data(1,0)

' h3 l! ?+ @) C: f9 c  Radmin_page_lever=data(5,0)
, C- _5 a& k+ l% [4 G3 E- D
admin_cate_array=data(6,0)
8 {  k. o0 \/ }7 z( ]4 Y: ~5 s
6 D4 i( O: a" B9 oadmin_cate_lever=data(7,0)

- j5 y/ }' G* _# oif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

1 R2 ^; h: f! Z( _6 iif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

7 R: ]6 i6 T! e3 ]7 H+ l/ pif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ J5 k/ J% n: N: y2 A( c$ d0 B) x
if clng(admingroupid)<>0 then
" L  e$ {3 p" q: J# g$ M( z+ Z
0 |& z0 ?: p' K6 x% E4 I# Cadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

sdcms.setsession "adminid",adminid
5 q1 W" G$ c/ b& k
5 o7 p' V+ W; v4 g$ s$ d' M4 Csdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)

. M' A3 f4 V- |  s6 d* Hend if

: j) ~2 E7 f% Z& L* ?! I' Xend if
( K$ N# \" M9 ^3 |* d' a: F& N
" U) T6 i$ f) L2 F6 m* S  g, s7 e/ oend if
3 D4 m# T; X& ]' B, H& v  ~3 A! a
; o+ J3 r$ C/ T8 q- |% a- qelse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
8 e& Q- W+ ]4 |5 J- d  v8 s
sdcms.go "login.asp?act=out"
- N% n& u: M& p; a. \
3 j2 \2 P! Q8 X( w$ ?exit sub

7 Z' H. u4 n8 Y+ Velse

admin_page_lever=data(0,0)
4 `' @+ m; \1 i7 m. F3 R; E1 Z
admin_cate_array=data(1,0)
# d) l; q$ a% Y+ @1 o  l, V- ^( l2 j
2 @5 W- y0 D8 P" Qadmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

$ g& u( |, f6 N0 k9 bif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
- j+ W6 B) H% E1 q: h' [
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
5 Z1 `+ g+ q  U6 j4 H' z  N
0 V1 |# j' q7 B, D* Qend if
  U* l' ]9 ?% M' V1 Z) T5 d4 B
7 `( K* [5 g' v7 r$ Gend if
. J7 v. t) o4 q: ~
end if
& @1 V, n# A% M, W' S6 d& s4 j
end sub
1 v' Y7 [; }  z1 z  H& _1 o; x7 ^* ^) @漏洞证明：
8 Z, i; B  m5 ]看看操作COOKIE的函数

7 G  N' R6 Q. }* x) ?public function loadcookie(t0)
) }0 Q- j1 z! p
loadcookie=request.cookies(prefix&t0)

* t6 v7 c3 F/ G- a% C5 {4 `2 L! Lend function
" {$ D) u1 j1 e6 G$ G
public sub setcookie(byval t0,byval t1)
0 N) I* O' ~( g% t9 \) @6 B* q1 _) b
response.cookies(prefix&t0)=t1

end sub
4 m1 G- `1 }  h6 ?; @
prefix

* j3 D. j1 D- A* z'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
: h  }' W5 X/ f; J& A1 w+ @0 @" P1 ?; W
! X  z& a6 L) Q/ cdim prefix

6 f3 b; v1 a4 m; L% ^! p, S( ^; Tprefix="1Jb8Ob"
- g- p. y7 N* w$ Y! M4 g! |. J
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
- o! V- M, A  V1 E
sub out

sdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

4 M8 T" D3 g( F* ?0 |, fsdcms.setcookie "adminid",""
& A7 ]* y, I! j8 f& R
sdcms.setcookie "loginkey",""

" M$ A! Y4 U3 J/ p: R8 C+ Usdcms.setcookie "islogin",""
: a: G) [9 X: I* P3 i1 [+ y# l
- H" s# k1 q, I  W9 csdcms.go "login.asp"
! {3 }) o6 p, R8 }+ A* [
end sub
3 Q* H+ N/ }) ?3 {* n
/ d9 G+ i9 y$ E2 m$ E
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
1 ?5 L) O. u9 R5 @, g& s9 `& d, _: p修复方案：
修改函数！
+ K! m6 q# H2 e/ J" r  x$ G