SDCMS后台绕过直接进入漏洞

admin

要描述：
: j. i9 \2 y6 [
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
1 I  S' W; Q5 d, y; _, B5 I  H5 @详细说明：
Islogin //判断登录的方法

& y: M0 d# \! v" D4 [sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
; U, |+ r/ x$ @3 C
dim t0,t1,t2
" b1 O+ e$ ?2 [$ S( D$ l
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
% Q. O3 f& }& l+ l, `
4 ~$ g9 i4 z% B+ n5 m* lt1=sdcms.loadcookie("islogin")
5 h# w+ s/ @9 K8 O: @, k% E/ ?
) `* r; R; k" F) `/ J5 tt2=sdcms.loadcookie("loginkey")
! `; ~& ?- D, n
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

2 s# I. l0 o) Z7 z  u, C4 e//
/ W7 I  d2 J7 M: O1 W  n
sdcms.go "login.asp?act=out"

9 J7 T3 _9 S" v5 ?exit sub
0 w' J; i0 z! L9 G, `
; l) _$ U0 P3 j" q% w4 Aelse
) L* {; f# v( G" G# v& q  X6 x4 I
1 d% n) ]1 a1 x9 ?dim data
6 |" u" V3 S% }4 I
: e4 w4 g' l$ Tdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
) \' y& m0 E; I* S
$ M) }' e9 ~8 Z  I& Xif ubound(data)<0 then
, o0 Z; s0 q% r
sdcms.go "login.asp?act=out"
$ ?6 _8 h, |+ j2 P; n  F
  |, I% _1 x) fexit sub
2 k  e$ r* ~4 u
else
$ ^+ r+ ]6 ~$ v$ A
* z) ~5 m# x9 f: F+ u3 Fif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

1 P9 E* ~5 C; E$ Q# h  L; jsdcms.go "login.asp?act=out"

% L9 z& W$ K6 o  pexit sub

/ E! Z7 D; j5 |% ^6 lelse
" A: N$ r3 S$ E2 c" E
adminid=data(0,0)

4 p/ {6 l. C& B* B8 @adminname=data(1,0)
0 v& \; a' {3 i; g: e1 @% b
0 m- E" y+ E. j. X% ]admin_page_lever=data(5,0)

  k; \0 u( K8 N2 @admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

1 g- B  h/ p3 T/ j& p% t9 Z8 G, [if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
0 ^  m7 E/ G# j) d3 N& h
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

/ n2 J( C. G& R' a3 T, Nif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
0 D8 e. b* B5 A2 o* ^1 N( z
7 @1 ?7 [" e, A( c" }* d! z' p2 nif clng(admingroupid)<>0 then
$ n, m9 c' A& \
6 \' r- Q) d. X+ n# k- s& Iadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if
/ c9 x7 N1 r' n' ~
& D5 Q6 ?, K. X6 M. U) Z6 _* psdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
3 a7 ~, X! S0 e' b4 q. V8 @; j
sdcms.setsession "admingroupid",data(4,0)

3 |: r0 f2 b. m7 w- {$ ^end if
9 I  t. h& y8 J! T
end if

end if
* P( k' g2 a7 X5 O% n% A
6 e) o7 X8 |. s! Q& melse

  p" b& m& }. m9 s2 b; N" Xdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
$ X0 N9 l. t8 v# }3 A5 M2 a( r
  x& k9 p7 G; U; N/ Uif ubound(data)<0 then
! M& o, a4 s, H0 X4 ~3 h" a
sdcms.go "login.asp?act=out"
8 K+ q5 T! `2 @7 ?
exit sub
8 K* C7 {3 `) ]2 P/ U7 y
: X# C6 g3 b" A+ X8 uelse
# K/ M2 g) ?2 r4 x# ^" i$ G# p
admin_page_lever=data(0,0)
! {7 A- n1 Y- |: a3 S5 g) {3 F0 G
# Y# p0 l& _4 U6 Z8 v, E6 ?admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
6 D$ O& C: z; S6 C
& ], r- E# b" ]+ l& B0 E4 M/ f0 pif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
+ a" s3 ~% M: i$ [
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

9 Y5 `; |: c9 G7 G2 Q8 h, {" dadmin_lever_where=" and menuid in("&admin_page_lever&")"
& H) `6 E7 m: w; x0 s2 c
end if

2 D* W! j7 r- ^5 ?% A; aend if
/ A* Y3 V$ z5 @/ l. @) Y
! d/ n9 c3 |5 Eend if

8 v* n/ [: n! p5 k4 c2 \! Zend sub
1 }& e* y& J; }漏洞证明：
看看操作COOKIE的函数
* i- H& D$ \! c' i) _# T& ~
% Y: F3 H! p8 N8 V4 _public function loadcookie(t0)
, W  Z# G; h: M% R6 O
loadcookie=request.cookies(prefix&t0)

end function

public sub setcookie(byval t0,byval t1)

response.cookies(prefix&t0)=t1
' {/ }* H8 F0 |0 S- b+ L2 _
end sub

$ f  e7 {# M3 j" v0 I( P. f2 Eprefix
+ V0 b" v2 ^& ]  z& k
0 O/ r  r9 P- J1 }  ?0 x'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

& s, m9 n4 Y8 w  ^dim prefix

prefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

& Z3 R- A3 `% h2 T4 S# T" ~; Bsub out

# Q( m7 ^( n0 z, y, ~. csdcms.setsession "adminid",""
* K: u7 [  j. W0 _# x7 H, e0 s
, `. ^3 w; A: s; O" D5 J9 n  x( K$ Ssdcms.setsession "adminname",""
  D: O. D1 \7 T6 ]- n+ X5 E
sdcms.setsession "admingroupid",""
4 |( S  K& w9 }5 z* ~8 a% k" y
8 z$ f; g9 K8 ?& vsdcms.setcookie "adminid",""
& F( n2 d# i1 p6 {- I/ ~
3 d% {' Z. _4 R* o% Tsdcms.setcookie "loginkey",""

" `+ t7 }$ A8 }8 u' _sdcms.setcookie "islogin",""

* ?1 E$ E6 }2 U& Q; |& Z; rsdcms.go "login.asp"

end sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
3 r' `5 P( |3 p+ Q! [) o1 ~修复方案：
3 i6 t3 p4 a% N3 v" U, ?( x. w0 @2 ~修改函数！