SDCMS后台绕过直接进入漏洞

admin

要描述：
: j/ F/ u1 Q0 ~7 P
* x4 j& I# N4 x! C; b) _9 BSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
) A3 g- C, B3 N& [详细说明：
. |! `9 D/ V$ D- u0 ~; D! E' YIslogin //判断登录的方法
3 c5 y+ Z+ v1 b2 l
( j6 X: x2 Y% p3 D1 _7 ^/ q# i* Fsub islogin()
. p) r* J8 y2 Z4 Z
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
5 F; k! K8 s9 z3 t  X
" I$ u; n+ Q% V- c( i5 ?dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

% s1 U! I/ H3 N) V4 kt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
/ E. Y/ V5 f  `/ ?: F
5 S7 E7 u$ F! ]3 V  O9 a9 s! A; m//

) M- ~1 \" L, _7 u; Tsdcms.go "login.asp?act=out"
. w: Y6 B3 }3 R# @& l
exit sub

+ T. O2 P5 f0 y% |else
. n+ x9 v0 r# u$ f8 [1 n* x' z( n
dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
3 m* E# E( T3 f- S# @% z% I( Q
7 t0 q: c3 B& N# Psdcms.go "login.asp?act=out"
. [; p9 o# u+ u+ b; l
exit sub

! r' ^: l7 b& V3 }/ w! Nelse
+ k. l# m0 U* \  l  T2 O
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

; R3 B9 T4 {/ C/ J: L2 E4 @sdcms.go "login.asp?act=out"
) |. w! |: C- A% t
6 d: m  H! [+ k7 y  E5 O/ J% Gexit sub

. R: o9 y. l% J4 t& G' Aelse

adminid=data(0,0)

0 X! ]  \1 R/ p4 iadminname=data(1,0)
1 ~  _4 v! L8 y% J, M
admin_page_lever=data(5,0)

admin_cate_array=data(6,0)
( A9 R  b6 W8 }' n5 N) U! H
admin_cate_lever=data(7,0)
* v0 \9 ^3 `* }: f
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
: |. u+ {. q( n+ s# C/ E: o
6 Q+ X; j1 M4 D7 M, S9 t+ Z, uif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

/ w+ w" f! v% o; n; Yif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
" V# G" {4 o8 _
7 i: s/ {# j  N9 Yif clng(admingroupid)<>0 then
& p( g# q4 t& c
  P* z) q: `/ T+ a$ oadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)
) o# w1 Z. y) F% D- _5 c2 u1 F3 b0 b, {
end if

8 J4 [! F+ I( z6 l7 T( k' S  Eend if

/ f1 y0 G; p( t7 k+ C* t, U4 p2 i' H+ ]end if

  z. O; q, j- O: j8 N0 gelse

2 T) A. ?! ~9 h* l% ~- Y3 Ldata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
  Q5 T" `1 l( P. ]* t
if ubound(data)<0 then

: C  y' P! l3 [% _3 }: `sdcms.go "login.asp?act=out"

exit sub

5 \7 v- {2 }2 ^. F( jelse

; U4 R3 G! W5 J# v0 P4 {5 |admin_page_lever=data(0,0)
' x. T+ w9 c1 H& T- h$ U1 F. _  Q% S. j
admin_cate_array=data(1,0)

! ]: K% _5 h0 I* W$ E2 R: Tadmin_cate_lever=data(2,0)
" I3 F; K  M; G" k3 G
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
$ ]" J+ S- N+ @+ z9 S3 h( Y, q( J
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
& v4 G: O' C' M
( x" v5 |8 ~3 P  Nif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
0 G/ f7 j9 t, x, V
if clng(admingroupid)<>0 then
4 B0 M8 g2 m( @% }* v1 H: y
admin_lever_where=" and menuid in("&admin_page_lever&")"

end if

end if
# i* W2 Z& M2 r) M9 C
8 w' y1 ]; g3 y4 Zend if
' p% E$ B4 Q# A8 t. ^$ w. l$ z" k& C
6 t4 A+ W# G5 K! i: d0 mend sub
$ Z* \5 {7 x) Y4 N- F: x# M6 [: P! i漏洞证明：
看看操作COOKIE的函数

. u- r5 J* p4 E+ N: [public function loadcookie(t0)
/ m, B, H+ n( d$ C1 |+ Z' Z
/ l) q& t" x3 Nloadcookie=request.cookies(prefix&t0)
: ~- ]8 s$ m( n) W% b
8 r; l+ e5 v. N6 G0 p5 w; c/ w; I' }. Vend function
2 T/ |" o& F9 P3 e
public sub setcookie(byval t0,byval t1)

7 [: S5 H5 _0 `& L6 Bresponse.cookies(prefix&t0)=t1
9 c: B1 [( W4 i) L) d' f: C
end sub

prefix
0 F: U7 M& o8 M$ |+ a8 K* \
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

& c  b" v3 z+ a& jdim prefix

+ w2 z8 W. U7 ?0 j& J2 \0 g, ^prefix="1Jb8Ob"

3 U  i/ q+ o8 b! X: \$ l$ _'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

; b* D, ?& p5 H/ nsub out
- a- R& [& ^3 |4 a
" q5 k' A6 u2 o  `. E4 S. M  ?1 G  Msdcms.setsession "adminid",""

2 ]! e4 ]3 g" [sdcms.setsession "adminname",""

# t; e9 G+ ~  N- {+ ]8 Lsdcms.setsession "admingroupid",""

4 W# g/ }  [/ E( k  @) }sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
2 F. t) h, ?) e' P
: u1 S- \# u6 H8 |  ?5 ?sdcms.setcookie "islogin",""

sdcms.go "login.asp"

+ O3 Z) }8 l# S8 [5 Gend sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
& D+ H9 a. b/ Q* B2 G8 I: a0 b修改函数！
7 a- O3 W/ c- H6 u9 b$ g" E1 @