SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
9 ?) C* D' z! O' r4 S" y+ ^, f详细说明：
Islogin //判断登录的方法

. ?, ~7 x9 Q7 d3 @sub islogin()
* \$ t. z6 W6 N3 G' v
0 ]3 Z8 y2 \) h1 xif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

7 Z5 J* V, Q5 p. |( [4 t' u* U' hdim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

& }5 Z; W, ^/ m; N% w& ht1=sdcms.loadcookie("islogin")

+ o( }& G. y2 O' R. ct2=sdcms.loadcookie("loginkey")
9 c( e/ X6 E! k# t
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//

( `+ m" ^2 ^5 q9 U' \3 N% |sdcms.go "login.asp?act=out"

: _+ `6 W) C. Z2 |& l7 ]exit sub

else

dim data

0 a6 {+ ~  Q6 k- Rdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

& {0 L% U3 w# S( Z3 V1 {- M2 G$ eif ubound(data)<0 then
3 @5 s* ]! s/ R4 ?0 w
1 [4 I- z# c- Y, n: Q& Tsdcms.go "login.asp?act=out"
) S! g1 W$ `; T) N' w
exit sub
/ x  E& \: N' Q/ d; D2 O, Q
$ i# p3 o, `1 v1 o- ]else

5 N' ]7 Z  O& Tif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

3 M: u; `2 X" a9 @sdcms.go "login.asp?act=out"
+ a. w; v3 V( L- R7 ?- u
exit sub
5 n6 m* n4 i* a3 l+ k) Q
else

0 V5 y' D* [! r% xadminid=data(0,0)

adminname=data(1,0)
8 w0 \! H. H" `3 d5 v
admin_page_lever=data(5,0)

admin_cate_array=data(6,0)

1 H8 D7 b% S) G" [5 ~( N) zadmin_cate_lever=data(7,0)
4 {$ `5 z- \8 A+ g% m
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
/ L, z7 r) L8 d! |# c) e1 b1 Q! Y% k
. d( s0 G% X+ l3 Uif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
$ g9 }# p( K+ s7 e1 d3 s1 d9 h
2 O* {/ S- D5 I* A6 K  i5 uif clng(admingroupid)<>0 then
# v  z+ ~( b! m/ ~
2 d" I7 ^* H& B, O, f# |7 Fadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

8 X, [0 R4 u5 ]sdcms.setsession "adminid",adminid
+ d# ?( j( {9 v6 ~
, d* K$ d% p7 }- M8 |sdcms.setsession "adminname",adminname

6 t/ D9 P4 ^+ W; B+ `# zsdcms.setsession "admingroupid",data(4,0)
/ u5 z. y9 }! q; m  R
end if

end if
; I1 `6 f- P2 E2 ?1 P# P. [
7 V; u) l" E7 Oend if
& ?% l4 i) O* O4 j
/ T- n. C% H, Jelse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

sdcms.go "login.asp?act=out"
6 M6 m4 u% P) s
6 h: z( I# o- k4 {, T+ [/ o! l, D0 hexit sub

else
% U+ p: h1 x# ?
admin_page_lever=data(0,0)
' y5 `  }6 r+ m- p$ ]
; y6 J" S* {9 e. g- K+ Xadmin_cate_array=data(1,0)
  O1 \- {) M( L0 i
2 F4 |  t/ l: l1 Eadmin_cate_lever=data(2,0)
* x. z" F$ S, i* E9 h, ^3 i2 K3 l
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

( D, `7 R1 g  S- s$ ~- V4 A. O: Iif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
7 j4 P+ x- }5 O% H( I+ M4 ^( v
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
# k$ ^, r/ ^5 e2 K
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
8 A5 Y5 U; E) w  i' u- W/ b; E
! ^, @; X, ^0 Y4 D! H" nend if
1 ]* B9 n0 w; B3 s# K
: v1 Z" R* j2 y1 P/ @end if
* f) a0 G* O; o6 Z; ~1 Q
end if

end sub
) O2 s6 y- S9 H0 W* k9 M漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
; p3 u& G- _& p7 W1 _! F* p/ F3 i
  F+ Q( z: G9 z) @9 ]end function

public sub setcookie(byval t0,byval t1)
: B) l" ]  B2 e
4 {4 U+ c/ G( I" z" H* aresponse.cookies(prefix&t0)=t1
0 L  n" H: j2 k2 b% e% B# m
6 h  n( j- c  J2 V9 Oend sub
2 V+ u' w7 [+ S! ^- U- R8 T
: X6 j  }: w4 F* K$ H3 n, H; Qprefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
" r% Z  W: l* g# v
dim prefix
, Y- K: j6 y$ C" I8 N4 u
3 z; K# k, j- w3 \2 n# s% {prefix="1Jb8Ob"

  }$ L5 W" o8 S% |+ A* D'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

' L/ H# p0 l1 L) ?5 Asub out
. Z+ l6 u' D5 W' E& R6 H
. T; _+ T$ l. Y: k4 hsdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
" i5 I( v8 E4 H) ]0 S4 ~- }1 w
/ [! g7 R+ Y. ~' q' ~# Hsdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""

5 X( ?) ^* U( \sdcms.setcookie "islogin",""

. ]6 ~  r% @* K1 F4 \sdcms.go "login.asp"
3 A( q4 D+ h% R
$ U& w5 N% w: d' I' F/ r* dend sub
6 _; g" Z2 w8 T6 y* D9 `
$ F# h; K: C# U) v( M
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
; Y, M, v7 u9 E2 a) a修改函数！