SDCMS后台绕过直接进入漏洞

admin

要描述：
/ R( @: {) {5 l$ Z/ \8 t- g
4 [' e) S- M9 J2 X+ t4 m1 ISDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
$ ^$ P; ]0 l9 U, P- Y( P! H9 X详细说明：
Islogin //判断登录的方法
1 u) z# w. k+ P7 k( d5 q7 n, L
' \0 E# o8 ^8 `  d- }" Dsub islogin()
7 U" p% E  t& r: `
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
8 M5 C( p& [  r/ k
dim t0,t1,t2

/ j( s& B) R" F3 \* f% i9 yt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
5 K+ [& m7 v% v' _1 r5 ]
' r& r( n% M" M$ Et1=sdcms.loadcookie("islogin")
* ?& \9 H2 O. c) Y% F4 X
t2=sdcms.loadcookie("loginkey")
% ]6 K! L% ?' x% i: A9 N* q8 |
! M6 T$ ]4 K1 h" n+ T7 Sif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

) F/ C1 T# u& G$ B" q//

sdcms.go "login.asp?act=out"

) y/ ^* _0 h8 b4 texit sub

else

dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
# `5 X/ _! k& W7 p
4 J/ y% p* g' o6 a. F3 eif ubound(data)<0 then
) i- v8 \- J+ r- e1 D0 S0 ]& ]
3 s! ^' |- z* R# gsdcms.go "login.asp?act=out"

exit sub
0 z8 A& y, U- {$ Z9 ?) A# p
& j% \9 }$ F% b# }# melse
. {; c# m: S. a% N
3 P8 l2 A) P' tif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
+ c( a9 ~3 t+ c- F
- s, ~9 K6 v  w! ksdcms.go "login.asp?act=out"

exit sub
7 O' H) J: F, X5 t0 e
3 U  i5 P$ z6 Y& Aelse
+ f5 q; z+ K! u) Z5 o4 O
; _3 g9 w6 T; d! E! M' Fadminid=data(0,0)

& p3 p* E5 _- r9 s& m, k$ nadminname=data(1,0)
: v# u5 E* \" e. L
" F& o3 N9 }. r! s1 \) yadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)
6 J  W6 J! B% v8 L
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
; R; b+ t6 `; @/ g! ~
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
4 y1 l: ~) o, T. \
3 X" ^/ Q1 `; I9 ^' ?+ {if clng(admingroupid)<>0 then
; D! B: F7 S: l9 p
1 B  s5 o3 e) `- O& _admin_lever_where=" and menuid in("&admin_page_lever&")"
+ j: P5 @6 X4 E/ m% N
* ?) q( M5 _% Bend if

. S/ E+ n5 d! l$ h8 U# Asdcms.setsession "adminid",adminid

: j! S+ j2 H8 n: w( t+ Ysdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
2 M) l* A* h* V2 F( D! _) F4 A- C
end if
  r0 G6 z1 }9 T& {. c* Y
end if

end if
( ?' e8 |" j. e3 V" G: I4 t
# G2 W; M; j# @  \- M: s6 }. ]# zelse
6 B- _0 P5 e( V
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
. B" N& c% n3 V9 Y1 b# B( _# p$ h$ ]
3 g; Z/ q" X. {2 ?4 ]if ubound(data)<0 then

* `: t, r/ W7 f+ R! ]sdcms.go "login.asp?act=out"

exit sub
0 c# l7 r# ^' ?2 E8 `7 U) Q2 P
else
( \7 {; ~' u3 B2 T5 S0 A
admin_page_lever=data(0,0)

admin_cate_array=data(1,0)

3 [# Z  Y6 a: i; wadmin_cate_lever=data(2,0)

# x% m& |% f: b1 q, O- zif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ W2 t9 G* g1 H7 e
; \9 r9 w' H! i8 O% yif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# }% [4 K" _* S, [
if clng(admingroupid)<>0 then

6 w" s& g8 j- Nadmin_lever_where=" and menuid in("&admin_page_lever&")"
0 [+ z7 W1 |* R: {3 @
* y0 R1 i' a' X- Mend if
, p  R) n' d/ }! e' n- m
* H) @9 F% {5 u  U+ ~end if

# I) i9 ?; L- `! l8 q/ N+ yend if
# w9 `2 t3 X  q5 \6 ^
! G( J- e: Y+ N$ f( s) Y$ G: uend sub
2 @& P4 `. L4 x+ ^# V9 ]2 l& X漏洞证明：
. S5 @: f( T8 {看看操作COOKIE的函数
/ p/ [" ?/ H2 O5 `* [/ |& e
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

& b( y% J7 Q" [end function
& l4 x6 ]; [* Q: n0 H
5 c2 f5 F5 l5 _" H4 Bpublic sub setcookie(byval t0,byval t1)
  M3 L1 m* T; H" L7 F' z0 G1 W
response.cookies(prefix&t0)=t1

end sub
- S" e. Z1 @- w
prefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

2 s: s8 O% j* j/ r, Xdim prefix

prefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
! n6 Y, N1 M' w* g
2 x: [" Y- a: e( ksub out

sdcms.setsession "adminid",""
5 G/ a. L' a. j4 {9 v$ |
sdcms.setsession "adminname",""
) z- x: T$ N, K, g  M' i
sdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

8 W$ u& I# P% H9 Ksdcms.setcookie "loginkey",""
6 g2 R1 k. V0 k7 W* h( F
sdcms.setcookie "islogin",""

$ S9 d2 C7 w% C5 W& x0 {sdcms.go "login.asp"

end sub
; A: `+ Y  p$ B# W

6 @7 E7 ?& a. B. ?) t利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
# u# G  E8 l: ^7 v& G( }修复方案：
: i4 X9 W' `6 L$ m# d9 l修改函数！