SDCMS后台绕过直接进入漏洞

admin

要描述：

6 |3 N5 r; r" ?! n/ t; \% cSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

. `8 m/ B* \0 q7 n' G4 Nsub islogin()
; G0 ^2 v- ^% T. p
' G* B7 s" j- D- ^. ?if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
& n; F; E0 F  b# u# N3 @3 D/ \
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")
" U* g3 T# y1 M7 {+ l! w/ f2 b
t2=sdcms.loadcookie("loginkey")
% n' w. c$ t' _7 C0 m! D2 Q4 T
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
; y; P- W2 L: Y# V& U
//

8 P7 Q* r1 g. f8 I4 Ssdcms.go "login.asp?act=out"

6 h. k' l6 ]4 Dexit sub
+ q3 _% i4 e2 k2 R
% I$ h, ^5 g# U* {else
! o( ]' ]: |) U% ~' e! l' O. f# Y
dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

# ?, J' g1 O7 I) w: Nif ubound(data)<0 then
8 k$ H$ R9 i/ n  R9 k
: \$ e) e- e. G2 L9 {/ asdcms.go "login.asp?act=out"
+ g& n/ G: [3 o* G4 T+ G
exit sub

else
+ @6 l! F; J: \0 X; P% l
0 w3 ?5 D* w" K9 s, |if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
: X; o" S, c9 S7 b
sdcms.go "login.asp?act=out"

1 I5 P8 `0 B) G* ~7 y8 nexit sub

else
& s$ E7 @3 R; w% o
: H5 s+ n, S; _% Cadminid=data(0,0)

adminname=data(1,0)

1 E5 s+ |. M  L. E* Badmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)
4 M8 |  z+ T7 P$ s. z5 s
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
& _; @# s/ E: `8 \* Z! |  U7 `$ ]1 M
( }; n* X2 j% G7 Iif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
4 i1 k% a  I% E/ l
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

3 h; |) `* B* T) A3 B" {9 y! u& xend if
9 |9 _1 y0 `2 y2 Z
0 I* ~( z& x& _9 Z/ [sdcms.setsession "adminid",adminid
' l5 Y& a4 Q: \3 G) ?+ W
; _5 y" k0 I8 p* n! l4 a6 rsdcms.setsession "adminname",adminname

4 r4 D7 }8 V' L8 q0 U9 x3 U9 wsdcms.setsession "admingroupid",data(4,0)
2 c- R- o0 R" L6 u$ o0 a
3 n# b4 N6 Y% Z& lend if

) n6 Q1 ~+ a6 V& O% l' q$ Fend if
! W+ u5 }/ X& k) N2 t
( S. N7 X" c2 I5 c8 t7 fend if
, c, i9 p% M6 T  A5 t2 L
else
# x5 w8 n" b5 [4 c: v
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

& c# l! J4 w) V& Z* t& o6 I5 lif ubound(data)<0 then
4 T2 U8 n, U9 [0 Z1 {
. Q3 Y% ?" q/ R8 T6 m* I; |sdcms.go "login.asp?act=out"

exit sub

else
: H$ C; L. u* R. B
admin_page_lever=data(0,0)
) d5 ~% A. h  W' ^7 b9 t* J8 s
admin_cate_array=data(1,0)

, k/ ]! `( l' q4 ?  ^admin_cate_lever=data(2,0)
+ F4 [3 ^# _3 J" w" j
; L# V6 k: w3 Qif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
  r: E, v& E* }* E0 V4 G5 _
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
2 ^0 M. ^5 ~' }
- d) _5 ]; y2 @. N/ Gif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
9 U- J) I+ V1 b" v9 [; s% t. Q
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
8 l8 `% {& W! E% d9 X
end if
2 A1 Y; T! O/ Z, G% g$ m
end if
$ c% T3 \- A6 j) A
3 N$ g+ W: [$ @! V' gend if
1 N: L: d/ ?! ^
end sub
漏洞证明：
3 W4 S) }0 U# r) c看看操作COOKIE的函数
; o* @) _) |1 _! u; M  b7 f, d
0 i0 |" T1 R4 [% I/ x: Jpublic function loadcookie(t0)
9 }4 F" s5 V5 ?8 Y
loadcookie=request.cookies(prefix&t0)

end function
8 A9 V1 a0 x+ i5 R) b1 D
8 ]! o0 H5 S' s! q& B9 ypublic sub setcookie(byval t0,byval t1)
; Y+ p& w( _8 x5 X' ?; k! `
response.cookies(prefix&t0)=t1

" @+ p  b( }3 _4 F, _. n0 }% y0 rend sub

- D3 D$ j3 b. Q: I" o3 M1 ?+ [prefix

! ~" R; p9 x# D+ `& y9 W'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
7 z& L- i- U8 u$ z! _5 Y! d
dim prefix

prefix="1Jb8Ob"
8 V& `3 u4 a& C( e# `$ e# m  l' g. m
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
; q4 L4 d9 X) d0 E! b! i& U
sdcms.setsession "adminid",""

sdcms.setsession "adminname",""

# J' C8 \; X: I; Nsdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

+ l% [* n5 d% e8 _) D( a6 Osdcms.setcookie "loginkey",""
( p$ S8 k: w2 Y/ b+ N, B/ |0 m
) @* ]$ ]8 x- D1 r" \; fsdcms.setcookie "islogin",""
$ d2 b: O8 R. G7 H* }' g) e0 e! s
& V8 T  C! l% q0 M; ysdcms.go "login.asp"
9 J0 P6 H) O' T* T# n" W4 x( L
5 X3 }5 e1 V/ c! s% Iend sub
7 l# B; G( y: i  }' c) Q( e6 G

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
+ h- q8 ?" C7 ^( v! N! J& f) H' N修改函数！
! [' v+ i: N" V- q* z, N0 i* n. d7 G5 y