SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
2 R9 G' K# E" e8 R: A详细说明：
3 J. N' J1 k# [; ]% cIslogin //判断登录的方法

- ^. g8 G, ^) V! m1 w* U/ a, vsub islogin()
* ?+ u) p) M* R2 ^
5 V6 s, X7 E/ S7 e6 a8 Fif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
2 Y# P8 ^" Z: L0 p
dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
# u( W, ^+ e$ z0 F- ]0 R8 h
) e( P: `  d: D* o) ~; Ct1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
% E3 q* p1 W) c  l2 a1 X4 V0 W# W
! H" V/ t& c& e* j" gif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

* l# l1 D' w! V. u5 g% h//
' I+ d6 z, W# h
4 L' ^9 _" `7 g( R" g5 rsdcms.go "login.asp?act=out"

9 B. L- ]  r; n' A; M" b- t  m0 x. `3 Vexit sub
& m% H; ]  S( V+ Y% ~
else

3 Q+ l) i- X0 h0 \/ L  Z+ [) fdim data
; o! j, \. y7 {* d. O9 E, `5 \- k
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
+ r8 y2 ~8 |( h% a5 S0 P* B
9 `% b. `7 c, g  i; Vif ubound(data)<0 then

sdcms.go "login.asp?act=out"

9 D( S7 [/ _. c5 ?2 }! kexit sub

" a6 f/ I) j5 z3 X- Velse
5 O/ P% T. f- S
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
$ X- }( j7 G8 }& j" ]( P
sdcms.go "login.asp?act=out"

exit sub

8 ~1 U0 A9 x! M6 s. R( ]else

adminid=data(0,0)
1 C# u9 n% ^8 \
adminname=data(1,0)
  i% d( `% e2 Y9 }
, n! |; j) i  D* o. U+ b3 _admin_page_lever=data(5,0)

. c0 E4 U! Y2 n- U% s" L) e' Qadmin_cate_array=data(6,0)
& _0 Q1 N( z9 V7 l: y  q
' K0 j. s4 k2 K" x6 K' q1 Uadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
" {; J  I$ x0 P" P$ R# {
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
) f# h$ M+ v+ w
end if
6 l& z) m1 _) w3 e# Q) k4 K& y% N
% m8 T& h% d) w- Ysdcms.setsession "adminid",adminid
+ E+ S  q; q1 ?0 ?, H. b% P
( c  q) U* e& ]% \" Fsdcms.setsession "adminname",adminname
. M& y- i0 I; J1 ]1 R
0 j; L, D: Z. ?; z* Ssdcms.setsession "admingroupid",data(4,0)
) B: X" \& a+ s9 L
end if
  w6 n+ C( c$ S1 X
end if
+ T& F' e+ {2 ?! U
end if
4 d5 B% V. E. H
else
4 c  d5 T, R; C
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

2 W5 m9 X# G2 p$ L9 u7 W) zif ubound(data)<0 then

5 Y% Z& Q6 h# u8 c2 |sdcms.go "login.asp?act=out"

exit sub
/ Y. L; Y+ f% F( E
5 r' b+ A! F/ ]* {# Q. Felse

6 g0 G  V% T  j- j% badmin_page_lever=data(0,0)
$ k5 r1 J) s% t% O% g
admin_cate_array=data(1,0)
  d- j5 i5 M9 C+ z. |) e
0 V3 g3 z' s: p* S8 e8 Vadmin_cate_lever=data(2,0)
$ A9 j* |" X9 a# Q6 g2 p
9 `6 E  F5 u! l0 E8 z) j) eif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
) r& E' {+ U9 X2 O( v& a
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
* D1 L4 h! @# f8 ?+ j6 @; X
  {7 `8 u1 N( {if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

( e; w( d9 D$ q% |admin_lever_where=" and menuid in("&admin_page_lever&")"

, p0 J( F: }) n( x/ D3 l% Rend if
7 v- |6 u5 w; ^' k$ X# s/ ]
; l# A' O; X4 X* `" [0 g! ~end if

end if
, N8 I3 s" k1 j+ B2 w. H
$ c' L9 z% h/ ?* {2 @1 dend sub
漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)

2 I# T0 K' V& G# k, Nloadcookie=request.cookies(prefix&t0)

+ S" n& Y; ~/ W( E" \end function
8 z$ u+ u8 E+ O# B8 A
public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1
7 d% T$ l$ M0 B+ o
% X' h8 G) P/ i2 _end sub
& i' h2 }9 H+ \. y) H
/ @2 i2 ?1 c) J  U% Nprefix

2 {4 ^/ Z1 l5 ^2 r6 \* v8 _'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix

; r3 E8 }& q- u3 D6 wprefix="1Jb8Ob"
+ L6 `' ?# [, I9 {9 u
( m. A. `4 J; o'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
  `/ ]# [( r1 W* {& t$ |5 o$ ~/ F
' U0 U6 }$ U; U* U# K0 N5 u- Xsub out

sdcms.setsession "adminid",""
5 Y# l- m0 D. s7 \8 _  |
& r+ q! b& q8 x9 c+ Tsdcms.setsession "adminname",""
( |) s( }# f5 Q4 u) d
' U  m, _8 W; W' N8 Q- g; H, bsdcms.setsession "admingroupid",""
6 J# G5 `/ d" u3 s$ J6 u1 _
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

8 }' z* i, ~( f, Y" z! @sdcms.go "login.asp"
3 C2 {0 d5 e& m8 D: D" Z3 s
end sub


; b6 F9 i& o4 Z- a$ x+ y) i) _利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！
$ [/ }: x$ N; s