SDCMS后台绕过直接进入漏洞

admin

要描述：
5 P$ A9 q9 {+ b& x8 W; H. Y4 s
! h( z& k4 S" w% B9 DSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
1 ~6 b6 @) r/ \5 u详细说明：
Islogin //判断登录的方法

sub islogin()
! o5 @7 v4 S3 r* R! Y
, F0 W! Y3 h* Y1 k$ `2 H. ?if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

* a" Z! F0 S2 P/ ?6 ddim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
1 p* H3 z$ ~9 J6 N8 W. ?! n
t1=sdcms.loadcookie("islogin")
  e  G  H1 e' h# F( e+ h2 b( O
3 M; b" S1 s$ O/ \) Gt2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

9 }0 ]7 g, ~9 X3 m  q. ~& S  g//
9 Q6 \0 T; o- Z% k' k2 o/ P
( t3 X. K+ s5 I* T" ~sdcms.go "login.asp?act=out"
8 _0 V4 `" s7 \/ r- |. Z
# A8 K& p1 W6 G( {4 Uexit sub
+ P) m7 ~6 U! A% D2 c7 h
else

$ X1 ^7 k+ ~; X% cdim data
# Y% L/ Q3 t0 B8 I$ N; a! K
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

( i$ o8 }5 v' Q6 u: T: j& ?, bif ubound(data)<0 then
0 ~1 N8 M7 O: c# l& |( k
' g" ^% _$ J8 M. `, ssdcms.go "login.asp?act=out"

7 A4 X' W# Y2 v) g! Qexit sub
1 l) Y1 |  }7 Q( y
& J7 A  T- j! Q9 h& O0 relse
. o( G$ H9 c5 w. j4 Y$ R3 ]- j* a
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
- E( k% j' P1 r8 o# S0 I
. Z  M! N7 j2 M+ e  @2 ^- Vexit sub

, I# x; D" w9 belse
8 P% n6 V' [9 e* g/ B$ m  `/ m. ?
- ~! r( \  B( t: j* |adminid=data(0,0)

adminname=data(1,0)

admin_page_lever=data(5,0)
4 J  o( k6 Q9 K4 c) \) K* `( o
1 ?0 c' v, a& H# sadmin_cate_array=data(6,0)
6 c* e3 p  |, x/ O; w9 y3 z7 J! C
admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

, G3 ~$ r; [  q# s7 E. Mif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
7 o* m8 }1 B% Z# e
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
/ ]6 L  u3 b2 w
6 ^+ m6 X: j$ u$ \% aif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
* b* Z0 A$ b* b5 v. N# K/ A1 x! ]
end if
2 X0 Q7 D& h/ L4 l4 E
sdcms.setsession "adminid",adminid
# R6 I7 e) q# M+ d' H, M: V" n
sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)

end if

! K7 ~, Z7 U6 k5 cend if

4 w$ R" y3 g5 [end if

else
7 ^* u( i1 c( B& M1 q$ ^
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
( c$ \4 v0 `+ s- Z1 U- K
! H, v- r! m3 G2 v% p5 oif ubound(data)<0 then
" G& V% i" ~% k3 z0 b9 F& J
+ \, }8 x9 `* w5 Zsdcms.go "login.asp?act=out"

exit sub

else
, Z# B& W, k) v  r1 x* i, W
admin_page_lever=data(0,0)
$ }9 ?7 j4 [' c* _# X! M
+ w0 H6 p- W; v0 r* I, Y. G8 Nadmin_cate_array=data(1,0)
! ]2 f9 m) P- D4 e4 a3 v! f# G8 N
admin_cate_lever=data(2,0)
/ I: K  [$ ~* `
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
; f8 f6 B: [  V+ T
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
, S& ^" f/ X2 r0 G7 Q7 K1 S) {
) U: p% }! C2 Sif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

* G: J) u5 m( F- I4 xend if
3 m. e0 M, i- U9 o% a5 Q* f
end if

* v1 D( f% j6 x$ ?+ }) I, s* Mend if
8 }) C4 _3 ?; z' R2 }! b- ]
) O8 j/ y' ^5 g9 e$ U7 U% }end sub
9 N+ D9 P# @3 D6 Y( H% U. c) g2 m9 e漏洞证明：
2 q, H, @3 [. ^看看操作COOKIE的函数

public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

$ N2 _$ D6 {8 a* gend function

public sub setcookie(byval t0,byval t1)
, U0 C+ n* t* g2 J5 e, T. f
! e0 Z! m3 H' h3 ]6 D( j; Q8 P; Iresponse.cookies(prefix&t0)=t1

* m, R8 n6 h$ B; Jend sub

prefix
6 {$ D. h3 N* q# v4 w
6 f7 p; @/ ?  w7 g% V! j  B'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
, N! i' P' `+ c! e" W/ I  |
dim prefix

( A& x) B0 U- [5 W: q; M5 Oprefix="1Jb8Ob"

! k+ A& V6 q3 p# P$ B, h  T$ _5 K9 f'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
: _: X* B. h, ?# E! M7 D3 H
7 X0 J' h3 ]; u7 F# w9 msub out
$ y* v2 K7 |* N- H7 m
sdcms.setsession "adminid",""

sdcms.setsession "adminname",""
1 q/ f+ B; ~( F. I
$ u& j* k" j$ O; n. c5 z% C( dsdcms.setsession "admingroupid",""

6 A* w/ f9 r$ n! bsdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
! G7 s) J' U0 ^4 c/ z- D
  x. d9 l$ m9 a6 s3 Q3 ]# [- zsdcms.setcookie "islogin",""
" w9 z4 O' {1 E8 I1 A
sdcms.go "login.asp"
, C& g. X4 G1 j* u  k; J. o  R& y# R
; P' L; C3 o* y) Y! P: B. Nend sub


. b, C! H" H' d0 k+ x  a3 K利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
; K( V5 B  ?8 V$ R3 M修复方案：
修改函数！
" }6 z! ^' Z: G( D+ K) D) G