SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
, z8 U  L( d: k8 mIslogin //判断登录的方法
. _4 C8 m: Q+ a( p6 X
% L2 V" P' k- L& q  _+ f. Hsub islogin()
" h/ L' G' M' V2 f0 J% e- R, ^
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

2 ]3 n: `, \2 b" ot1=sdcms.loadcookie("islogin")

+ i- W. b/ J9 o+ O4 y- w/ Ct2=sdcms.loadcookie("loginkey")
) j1 P9 M0 _- H0 u, L) T5 B
) W* E: S% _7 g- R, N5 t0 Y% jif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

6 h* c" S. z9 N' ^: x$ g//
; X/ x  y7 Z, \% `
sdcms.go "login.asp?act=out"

5 `2 K# p3 P" v" g% K+ Oexit sub

2 h- W) @0 K! S3 P7 xelse
- N# K3 n: F7 z: {5 W' @# k
$ P3 j" p+ G( j" U- f2 F" u9 ndim data

% d% g0 c$ ?2 t0 Vdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
6 y7 q  B8 D; X! [+ C2 o
1 i$ A4 |- }/ |* i8 osdcms.go "login.asp?act=out"

. `) J/ b' Q& Nexit sub

7 J: O8 E% l- g9 o* H* F- J! ~+ Eelse
; ^9 ^" f& a4 O) d. H3 I
3 |# B" \4 U# z% C( p( Uif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
2 k$ P  D( P. s& _8 i( N
! [& s) h8 ]# K$ e0 O( Ksdcms.go "login.asp?act=out"
7 Y# X2 \' X) M/ ]. c
0 S/ E6 @4 u7 z2 w* K* C# mexit sub

else

adminid=data(0,0)
* R1 }, v3 ]* }- a  R; p6 L; h
adminname=data(1,0)

admin_page_lever=data(5,0)

admin_cate_array=data(6,0)
7 A; j5 p) a1 Y' P1 D
admin_cate_lever=data(7,0)
) F- l6 [4 x1 N* T9 Z8 m
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

+ H$ \. L% v9 |if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
' P6 i: f+ z" i
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

9 C3 Q* n- T4 ]5 P$ p4 Hadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

3 o' F1 z( Y. T& usdcms.setsession "adminid",adminid

$ Z% i- ], R  B; s" r# N5 jsdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
/ X: _9 O* V& ?# T1 J( a, p4 a
end if
7 u' O& c2 F/ m8 ]* q' H  s! p
# d. b- p( R2 _! J! r6 kend if

end if
! W5 A0 J+ S$ |+ w
0 ?( ]( H" Y1 |# c  kelse
8 Z9 e" n, U# ]: T0 J5 E3 v
! e6 a/ X0 E  O% F* B/ R( ?# Edata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

4 ~' ]: b5 e5 A+ N2 Lif ubound(data)<0 then

8 ~0 f" m6 Z: J! B$ P8 `, Isdcms.go "login.asp?act=out"
0 }3 z5 z2 @# Q4 g+ ?
exit sub

/ I) v1 i; T. h, b2 v  ]/ C" V5 felse

admin_page_lever=data(0,0)
1 |8 ^( B, I% f; P! A' T
$ q+ }) h; ~2 D0 A& _1 Z, Padmin_cate_array=data(1,0)

admin_cate_lever=data(2,0)
+ D, s" F1 l2 d
# H8 F( b' ]( tif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
* I# T, m; \# Y# t/ D; z, L
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
% Q8 ~. P8 R+ v% q9 {$ o
2 k( `8 ^9 n9 \) Y6 T, yif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
5 a& l% s$ O6 U1 ]% ]
admin_lever_where=" and menuid in("&admin_page_lever&")"

* j  x- S( B6 U  X  v: ^end if

end if
2 A* R0 l* N+ L
9 I5 `* d* F/ [3 X( s. gend if

end sub
漏洞证明：
看看操作COOKIE的函数
/ \  D# M# @# [$ t
" \- ?  ~, |2 `; K1 |  C* S7 Cpublic function loadcookie(t0)
/ P, ^  P; T. z2 a1 d, C
* N2 b( E- Q) Eloadcookie=request.cookies(prefix&t0)
& Q% v: M3 J7 U& E; }
end function
9 ?) x* d8 y. y: m# h: L  V4 W
" g3 \; s; r, v! jpublic sub setcookie(byval t0,byval t1)
$ A/ i9 T$ C  K& o
3 t4 p$ j8 ^+ [: {( i" [0 Q: zresponse.cookies(prefix&t0)=t1

end sub
# w6 T! L0 `  J
prefix
, `+ t3 b3 E+ O' ?) V
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

8 l& N( m& Y( E0 K& O: h4 Sdim prefix

prefix="1Jb8Ob"
9 F+ k/ x% ^9 p1 R" N
  \$ h+ }8 `! {; ^. j3 w6 a1 q3 M'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

& D0 e" F, k# m. }& J& Dsub out
9 r; n4 L! N0 Z# t& J
$ L6 S* _9 u; Usdcms.setsession "adminid",""

3 P, V. ~' F4 N: v% O8 |$ Isdcms.setsession "adminname",""
! ]0 P' F* \' W  @+ _
* [0 U! X. D5 ~% C- Ksdcms.setsession "admingroupid",""

5 O1 t, G5 x. _1 k7 G4 gsdcms.setcookie "adminid",""
) B; O  b( b0 b# l. ?8 w7 ~
sdcms.setcookie "loginkey",""
, [8 f- i* Q. J' Q7 Q
sdcms.setcookie "islogin",""

sdcms.go "login.asp"
1 S/ t# b" N+ l  {
end sub
' S4 H% _: s# A

# w7 y" w/ V; L5 q0 g, |0 U利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
  M* N. b3 o. Q4 h修复方案：
$ p3 \9 e; f: C6 B3 k! \3 ^修改函数！