SDCMS后台绕过直接进入漏洞

admin

要描述：

& j* ~0 k0 u7 u" l) z& M  lSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
4 f8 W0 d' K: t7 E6 V$ B* _Islogin //判断登录的方法

( A9 q7 F. @, }/ vsub islogin()
$ }0 F0 p; {5 ?2 S* B
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

, |3 ?' B" p/ }& W+ w' q  o/ wdim t0,t1,t2

! p. B" }0 F1 U1 J1 t, y, E/ jt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
! \' ?, P$ O6 S8 r3 M$ s  h" h. @
/ @: `& X1 t7 V1 j% C$ Et1=sdcms.loadcookie("islogin")

5 q* ^$ \, o" P: v0 Wt2=sdcms.loadcookie("loginkey")
; A. t% B1 |, N. @; A; B* }
# a0 Y3 n' k& s1 P; Z$ Tif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

7 N" C/ Y+ f  l//

: X2 w8 E/ Y2 ]: ^) G2 z: ^( ?sdcms.go "login.asp?act=out"

3 A$ F! I4 Z( s* @0 D' I$ H+ l. \exit sub

else

dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

) K+ j: {- H" iif ubound(data)<0 then
! t3 c, ]( ?" x' T! G( {
( ~3 p5 ^& m5 D2 [8 C& ssdcms.go "login.asp?act=out"

. L* l- F, n; [& S+ k" b; Vexit sub

# }/ V/ I; A% c' yelse

: q$ v. p9 ]  Aif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
5 w$ l" m8 ~# w) |
$ K+ {- U: n1 X5 n- Z5 S9 }$ D# L/ Esdcms.go "login.asp?act=out"

exit sub

# w  t' j5 F  p& K- M, j' eelse

% I( i" q6 ?6 {- t( Q6 yadminid=data(0,0)

adminname=data(1,0)

admin_page_lever=data(5,0)

admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)
) [  |2 K  x5 n2 P& F
* Q' o% W  S) L1 R6 D, dif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
( F' m+ ]6 @- @  v) Y3 r
1 |) _" w3 B" W: d  Vif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
' X2 _  g) ~4 M: r
8 F9 Z6 V3 v+ W4 C5 Oif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
( R& q7 a! Y& u8 o! p$ E
/ V9 a" F& U+ R8 }- Q5 Pend if
8 z; L8 t( F2 a" A& i- D9 N- Y
# D; _9 b- G/ R: ^; E' a- v" Y7 B/ gsdcms.setsession "adminid",adminid

7 n; s- w7 C0 {. vsdcms.setsession "adminname",adminname
) }8 Q: }9 A; g- T/ Y
0 p( c. ^. z. ~$ Z) x2 Zsdcms.setsession "admingroupid",data(4,0)
+ K: e0 R1 f6 }' j4 v8 b( L/ _
" J# r2 x1 J; x  send if
  G2 y+ X* {2 N8 t# X: o
end if

end if
# Z6 l) n! r9 }- x+ T
; ?7 K! Q/ u, E. l) a2 _8 welse

$ c4 @/ h+ p) Y5 E* X3 e- wdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
2 E1 ^0 k6 U  A$ ]7 x/ L
if ubound(data)<0 then
, x$ ]) K6 G/ c# r8 H, s* @
' P* Q$ Q2 I9 g. u! Y- psdcms.go "login.asp?act=out"

, ~4 P- H: S9 c) z( iexit sub
0 K/ C9 u7 D* `1 _
" n) ?- e  [. k9 felse
. y1 O7 {7 h! f2 n. |+ ]' c
admin_page_lever=data(0,0)
" p, V5 _% V. A( h1 ~  o9 D% p
admin_cate_array=data(1,0)

  {3 {! g: [+ e! e- q' ]admin_cate_lever=data(2,0)
# H2 o- h7 J, f9 h9 o
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
' P4 J1 o& s6 C7 i8 \
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
1 T, t& p8 u( i1 w# _/ U: I
% V0 T7 Y; z" |if clng(admingroupid)<>0 then
2 ^- M  ~( B* @: G2 ^, B3 R
admin_lever_where=" and menuid in("&admin_page_lever&")"

end if
# v# t: v& I% I, H
end if

end if

end sub
  l# z8 \: K& c# x3 |! F2 u1 k' s+ F8 r+ q漏洞证明：
看看操作COOKIE的函数
  \. |. t, E7 h/ ?
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
  V8 g+ I- D1 @! I* Q# K0 q, W2 z* P
end function
8 ]1 o6 X4 u3 b8 d' W' A3 N
) b' _( K, S" g6 N) S. Hpublic sub setcookie(byval t0,byval t1)

- E) {$ S% u( J/ ]- G/ R; C. ?- A5 `response.cookies(prefix&t0)=t1
  `3 ~  f( Z0 w  ~7 Z- z
% j0 o* Y) P: ^end sub

& C4 B4 b8 h9 v' \' T/ p# vprefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix

prefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
1 f1 p& {8 r7 y/ V, o3 C4 r
5 h2 x5 s3 ?; |0 k( {1 q% Osub out

sdcms.setsession "adminid",""

sdcms.setsession "adminname",""
3 b/ F& W5 c5 D( D1 c, a4 w  b+ V6 w+ ]
5 q5 y& h$ t7 Q- }, e5 tsdcms.setsession "admingroupid",""

: d' i2 U, ]# k8 O7 ]& usdcms.setcookie "adminid",""
) O5 F6 G) Y/ ?* F0 }
sdcms.setcookie "loginkey",""
' z3 |" m- U/ d( |3 x: C
sdcms.setcookie "islogin",""

sdcms.go "login.asp"
- `8 R0 h2 l% ~% [
  Y% D, r" o4 A  Y  K* tend sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
* O8 t  A, ^- R9 Z, o& d2 Y* ^5 e修改函数！