SDCMS后台绕过直接进入漏洞

admin

要描述：
# d: G! w; K% _1 X+ I8 }+ t4 Y
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
* c, \% v3 s5 z3 I详细说明：
Islogin //判断登录的方法
: _6 i+ |* ~7 ^# ^' ]# `
: g: A3 k: [8 }8 G2 Isub islogin()
  r+ h8 A! a) U3 U) P& m0 o
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
8 O+ W  r/ N: j! b
; w5 _% E# ~' }5 hdim t0,t1,t2

/ x$ b+ h# P- H3 ^' h* Y6 H9 Xt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
$ z: G+ z1 ~2 {  Y) g0 D
' n. t& ]7 V! L3 Y$ kt1=sdcms.loadcookie("islogin")

4 A9 b+ u- G; P% y0 o* o9 st2=sdcms.loadcookie("loginkey")

! {( |9 A, ?) f8 D* `7 zif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
) [  ?( \6 [& T+ C3 [1 w1 D
//
* @6 `  j, E0 q- x$ ?2 M
sdcms.go "login.asp?act=out"
: V4 P% K! c3 p- `7 u# R
7 f/ o) d' H! ~/ c  bexit sub

else
3 Z) T  T' f4 a5 h7 F- T
- A: C' q  P0 c6 Gdim data
. v4 A1 Z0 Q: \. i
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
. i4 g4 Z( x- q* T
; S8 Y; `: w4 x' {5 {. cif ubound(data)<0 then
( a+ t4 U6 n6 E0 `1 x8 W* B
sdcms.go "login.asp?act=out"

exit sub
! z& W" R5 ~: m7 i" K1 ~1 B
else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
, ~5 J# |2 `/ Q0 e6 j1 B
sdcms.go "login.asp?act=out"
$ K; f$ J; ~6 @  V/ J
exit sub

( d% R* Q  Q9 _5 e& {' Lelse
3 ]) {! v; i. b1 i
4 B* I) |- i# s& t$ Eadminid=data(0,0)

2 Q4 Y: S- ?7 I% Radminname=data(1,0)
" v+ ?6 b/ m- `' [. n
- t' ]) z4 k2 I: [& Y/ Oadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

" I1 j) F0 z2 w5 v; N! \8 [+ oadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
* R/ F( g; t1 E
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
3 w" Z/ R0 s5 t' p1 Z9 t9 i
# X* E: W: m' [; n1 F# q+ `" k' fif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
2 p2 B5 w0 L: [8 f6 }
+ [" V: x: w5 \: pif clng(admingroupid)<>0 then
( M+ a0 x, _- f: W# u2 X8 t  ^* P
( s7 H* z2 D7 |3 b! Xadmin_lever_where=" and menuid in("&admin_page_lever&")"

" v+ c; G$ P7 ]6 l2 ]8 oend if

sdcms.setsession "adminid",adminid
) e' W/ \' V5 m1 f' k7 h. v
5 I4 I6 O) ]# J7 A' r/ Isdcms.setsession "adminname",adminname
( z0 w6 g5 ^( a1 M
sdcms.setsession "admingroupid",data(4,0)

end if
6 x+ q7 m/ D1 v3 I7 E6 j: c2 V
8 t9 K) H8 o: _2 q0 @end if
& Q6 M/ u. W; C* w! z" |, l
* Z$ U, ^: d1 V7 k1 j$ a3 aend if

: \$ [$ D& ~; ?: Q' |* \else
3 {2 r1 j) c, Y+ v# f, _, t! c0 r
0 z2 Q( C5 E( V" p5 k( U8 {: w. |data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
; l5 H/ p7 M2 K( R4 z
if ubound(data)<0 then

sdcms.go "login.asp?act=out"
0 E, N' _) d+ U$ O
9 n3 `) t( ~! X$ M# Vexit sub

& l" M+ d% z3 K+ X: X# Q; S' G! Velse
2 S, @  H) [4 E1 w+ \) i: r
admin_page_lever=data(0,0)

. R2 b2 I9 X+ k6 [admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
: W) r: N+ j: F$ o# a, H
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
# @9 o' H) H, P) k2 S9 u3 N
* f5 O. g8 M: t; \if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
5 ~' M0 w5 r( Y; U# {9 Z
8 v$ U" Z3 }4 E/ _6 O$ Gif clng(admingroupid)<>0 then
) O- K- z' P( r
admin_lever_where=" and menuid in("&admin_page_lever&")"

0 Q! ?  a  w, _1 Pend if
; i  J, ^6 Q8 G
end if

end if

' {( l: U0 u' h, e! \) f! \end sub
( q( m" S. f" L# M6 O7 a6 H- }漏洞证明：
+ z0 R7 M0 z& M& y看看操作COOKIE的函数

% @0 G2 Z; T  Spublic function loadcookie(t0)

/ a$ q! z( m2 S4 h8 v- ?5 d% J5 sloadcookie=request.cookies(prefix&t0)

end function

1 N# L% [& J+ {& F0 jpublic sub setcookie(byval t0,byval t1)
# _; m# M9 `( ^/ s  [: L
: S/ _5 s: m$ M% m0 ~, d$ f; fresponse.cookies(prefix&t0)=t1
1 |2 i3 J; V$ {6 |
end sub
6 |0 T/ L9 y$ k
4 f7 t6 G/ P, O& f/ N7 S7 M7 p: [prefix
3 l" r  n3 z* H% O1 T
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix

prefix="1Jb8Ob"

" m( n; A" J0 s& G1 I/ A'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

7 T5 w$ [  n# q9 x! E: L8 fsub out
, Y6 Y: @0 M+ k; l$ M
sdcms.setsession "adminid",""

2 c5 C# Q7 J+ m6 ?- W3 P" u" M4 Msdcms.setsession "adminname",""
7 p, H! \+ x! L  D
$ s# W' M2 o" c8 }( Csdcms.setsession "admingroupid",""
2 s1 A% D, ^4 I! {6 P" A! R! g. i
sdcms.setcookie "adminid",""
; Y: m' f" \; U2 @
sdcms.setcookie "loginkey",""

! [2 a. z  r0 v# @5 C6 Gsdcms.setcookie "islogin",""

sdcms.go "login.asp"

( P4 A: c: z* v! ~end sub
- u' i- L4 f0 B5 R# v, _0 R6 s

( R% s# T: K  g$ z利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
6 `- s" N& Q) m4 s+ ?8 `0 G修复方案：
修改函数！