SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
  k& _3 U  n; E; i/ o5 ?( ]Islogin //判断登录的方法

sub islogin()
) {+ `2 \: F0 J  ^5 p' y6 e3 z
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
  N" g5 l5 ?4 M
dim t0,t1,t2
) h2 _- h/ v& w
" G. H8 ~& F! F/ L0 n' lt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
8 o5 C! [2 a2 x4 H9 n  _# z( Y- r
( b+ s5 o$ X( ^, U# E5 ^7 J//
9 \' B8 B1 S9 ?' F
. S1 J1 c3 P/ X: H: R+ b9 Vsdcms.go "login.asp?act=out"
" ^8 `5 o' A8 d4 P/ _
exit sub

else

* B3 P3 W2 n9 s! U5 m# h) ndim data

3 G3 I5 l' U- A  o* wdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

2 ]- H" r; I, L( y( xsdcms.go "login.asp?act=out"

% K( n; R, ], d3 N3 ]' A0 \exit sub

else

* }# H  W  \, c: p9 n; }if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

9 U2 c9 o9 D  isdcms.go "login.asp?act=out"

$ b+ a" _% ~8 S, Fexit sub

0 }" v; k$ r2 ?2 ~) {/ Helse

( Y! l. R% T5 a8 f. v3 Gadminid=data(0,0)
( [9 C% A6 q! J* m) Y% `8 F
. M& X5 m1 t! x0 N9 padminname=data(1,0)

admin_page_lever=data(5,0)
4 E" n. D: P6 s8 x  `  h& s
admin_cate_array=data(6,0)
" y& i. I2 z( ]$ @- Z" K
admin_cate_lever=data(7,0)
/ d8 z8 I) H; L0 C/ G/ j0 x3 T
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
; h3 f0 p. u& f0 Y# W* W4 z
) ~. F' n, O- F0 Mif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

7 ], P  g6 a3 n! kif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ k( o' Q+ S( Q' [! d7 }: Z
if clng(admingroupid)<>0 then
2 M. Z2 w' w6 i- ]/ @
6 ]' C& Y/ Z5 }7 nadmin_lever_where=" and menuid in("&admin_page_lever&")"
+ `8 t0 g, g0 N1 U* Q3 [& @: y% o; r) J
7 Y9 T3 j9 o4 i2 `- r9 mend if

7 o1 G5 Y8 B# c, i8 `& D! Esdcms.setsession "adminid",adminid
& s8 F$ j& K, A' Z$ H% S
sdcms.setsession "adminname",adminname
2 b  ^. P* ]1 m. n; W0 X4 o& \8 W
$ \5 {2 x4 L6 [) e: v! v  psdcms.setsession "admingroupid",data(4,0)
5 q4 h: \. x* m& D
end if
# I' o# m2 o) J
1 f1 B% ~. T" b: u% i+ L& q+ Rend if

0 z( L  s4 W  \# lend if
. |+ t# f: \. O: b" P" T
" I- b5 J; ^7 ?4 _. v& n/ x8 gelse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

3 @/ R6 D3 H8 q! w9 mif ubound(data)<0 then

0 T* T8 G/ p& r# Y- z8 Usdcms.go "login.asp?act=out"

exit sub
. @; C, f! ^* S# \6 ^! b; z
8 v  q% B/ ]4 u( ^7 J4 [else
+ x' Q& ]2 q4 ^- S5 t
admin_page_lever=data(0,0)
6 r9 @+ N( o$ g3 G. }* H
admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
1 y1 W- @$ e+ _" G
9 u' E9 K5 A% Y( |9 R* mif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
* ^5 \0 F" y) |* A$ a4 U6 v' d3 r7 n
admin_lever_where=" and menuid in("&admin_page_lever&")"

# g! L' w0 C/ Z- Zend if
" c  ?6 F# D2 A" {1 B, D, b- A
end if
+ |$ B3 m% z% O7 C' t+ x- O4 V+ f
  J9 V! G3 R. H1 Qend if
  e- F* G9 @" y* i% Z/ Z0 [4 v
6 k7 u# i  H4 R0 r1 b- V' ]$ ?end sub
漏洞证明：
看看操作COOKIE的函数
# a" H8 l% p3 M5 {, ?" _
: b% Q& g7 S$ n5 B! Opublic function loadcookie(t0)

: t9 d# n/ F+ W2 p' Q7 tloadcookie=request.cookies(prefix&t0)
1 z/ N9 S: o$ d/ T5 r: h1 E
2 T. n, ^# a( W3 S6 G1 V2 g- wend function

3 F5 }" t1 V9 y* R( ?# o, a* h* O; ypublic sub setcookie(byval t0,byval t1)
+ Z+ T. W4 j- q/ P# ?8 X
1 L( J+ s5 M( y4 bresponse.cookies(prefix&t0)=t1
4 ]: S1 i/ l$ t
& I( L# D0 ?# k; W* J  mend sub
/ s& }3 {& D* U4 u4 h2 z; J- @
  \5 `0 P  q! {: v; C# {prefix

* b" y1 U8 ?" j7 U) ^1 v9 T) J'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix

prefix="1Jb8Ob"
- s! j* q2 s. }5 L
9 ]: K0 {- D8 {/ y, P'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
1 _# ~) ^+ C! }# v- e* o0 P7 u- E
9 _+ A  ~/ [5 bsdcms.setsession "adminid",""
# o9 Z- c) f0 V7 z3 s# U5 O8 b
sdcms.setsession "adminname",""

- M# T  A! |" n- nsdcms.setsession "admingroupid",""

sdcms.setcookie "adminid",""

9 n4 a# p1 {: ~7 vsdcms.setcookie "loginkey",""

sdcms.setcookie "islogin",""

sdcms.go "login.asp"

end sub
+ f( s% E  `; t9 p( B8 B/ m

' d  }1 y+ X% G2 u& j利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
; S: I, X5 j8 p  W+ B& F修复方案：
3 j( D' v, `& h) _/ f6 m修改函数！
) G3 |1 }/ l3 s% i" V2 \