SDCMS后台绕过直接进入漏洞

admin

要描述：
' |; c" B! l6 q/ }
SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
+ e1 M& K" K/ F5 e8 E3 }4 BIslogin //判断登录的方法

sub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
# y5 m3 ]! `4 c, N" ?
# m( m/ {+ v) f/ idim t0,t1,t2
+ L3 m6 Y. b' E2 R
% A6 k. {, L' V1 |( U+ [t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
; i7 a2 B( G  m5 _- w2 l) c
t1=sdcms.loadcookie("islogin")

, K5 U) M" {# e' h+ X' p5 F' n- Yt2=sdcms.loadcookie("loginkey")
; K+ p2 z: @# l" Y
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
0 {0 N+ ?& j/ l- t2 V
//

sdcms.go "login.asp?act=out"

exit sub
0 K" I5 G1 Y' B% V" u3 |
; u. |+ ?7 a5 B1 o( melse
9 g; Q3 o. y" u- {9 V) }
dim data
$ O1 @; d8 g5 u( r/ v/ ]5 d' c* r. k
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

. t% ^) {' b. [" s7 _if ubound(data)<0 then

# Z. ~0 j- _1 g( Fsdcms.go "login.asp?act=out"
0 @1 X, S* J& W% g4 I
% K7 g2 U) r/ ^8 d2 ^) p: C! a9 vexit sub

, A+ c) ^8 _7 G5 C- Jelse
- Q1 v$ A0 w+ ]1 x$ I3 Q, b
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
. h. N& |8 X, j) I# t0 V1 x) C# Q
% s! ^- T1 C# g; _2 `* V0 msdcms.go "login.asp?act=out"

! V/ e( M4 y4 a0 }; _exit sub

else

adminid=data(0,0)
1 Y  @0 y& L" w
adminname=data(1,0)
  h+ _; r+ |1 x, u, d; G; g2 f6 |
6 a0 f- N) w! w# x* D- aadmin_page_lever=data(5,0)
: X; g+ r2 m% V$ \
7 a% J, Y* d5 n! {- m. ^& N: V* N2 Kadmin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

6 M7 `% x8 T; O* n* ]4 qif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
/ \" x3 X! p0 b
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
+ \& P7 R9 o+ Y1 y2 ^
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
% A+ r! C/ X' }* J) h( G* i' d
1 D1 g! D. J5 send if
$ q" ?! q! E. `+ d7 M
; B1 [9 Z$ b: Usdcms.setsession "adminid",adminid
& B$ q6 u* a* L/ `
sdcms.setsession "adminname",adminname
6 r" \( r7 y, l: p0 R
sdcms.setsession "admingroupid",data(4,0)
& b+ W8 A* h, D
end if
/ M4 y) Y" O- M/ R7 {
end if

5 t4 h% T" V# n+ Fend if
6 [) H+ i) R" g7 _' A4 N
else
" ~& _; P& y- E! }8 b
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then

sdcms.go "login.asp?act=out"
, z/ G" K$ B6 {# v% e' H6 P
' s/ N+ l( l- W2 W' d9 L; Y0 i3 Q& Lexit sub
6 d4 K- w6 H/ N0 T! a
else
) E& T: x; Y7 ^0 J* J
- T3 |2 o, A. t& n5 qadmin_page_lever=data(0,0)

; m8 J# m) L/ I% f4 m6 Oadmin_cate_array=data(1,0)
( u* w/ t' j0 r
admin_cate_lever=data(2,0)
1 P1 m/ Z2 f6 }+ g1 q
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
3 I! @( w* x9 p- f8 c0 D: p4 l
  f. r) ~5 o. }$ ]$ H% k, |if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

# j0 E. f# t, ~2 ~. Dadmin_lever_where=" and menuid in("&admin_page_lever&")"
5 z) S7 d6 H; Y- i. d
) q+ @! \" q. T' V' S6 Q& S( h! uend if

end if

end if
* N" T% O- j! K. N; ?; W  o0 m* H
end sub
漏洞证明：
9 {) F1 d. D7 ]# K; x- A) S看看操作COOKIE的函数

$ x1 m; M, r" _% [# A% ^' |public function loadcookie(t0)
) a- _" M7 Y/ D4 P+ U9 ?' R% s
loadcookie=request.cookies(prefix&t0)

& b! f$ p0 n4 v( K. @* u1 Kend function

) S( ^& G7 w# r4 q0 Npublic sub setcookie(byval t0,byval t1)
6 I; p! T( u, u2 W' S
response.cookies(prefix&t0)=t1
% N4 X  }6 O# c9 V  X: C
end sub
5 I0 C1 C" i+ b! G3 [
/ e& a0 Q1 C. A% a) yprefix

7 i# h& {7 y8 t2 a$ h'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

2 R. ]! I; G1 E: e* d2 X! idim prefix

. @2 S* j9 u  P  ~4 [6 b- oprefix="1Jb8Ob"
. r4 ?8 _* ~3 ^  g
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
; D5 E& A3 R% g' V$ t
sub out

6 v9 N+ K% }& _  c# lsdcms.setsession "adminid",""

$ E  N1 `  p3 k$ [. S* Tsdcms.setsession "adminname",""
+ D2 o# W) e9 h# V1 E2 ^/ I. H& g
" T! O; @6 r, |! v+ }sdcms.setsession "admingroupid",""

1 `3 I( @3 [4 T6 Ysdcms.setcookie "adminid",""

: @7 t5 b) W9 @, B; Y5 l  M6 Y8 wsdcms.setcookie "loginkey",""

; K: k# `0 ^3 R  C! s; psdcms.setcookie "islogin",""

sdcms.go "login.asp"

$ I8 J# u0 D; }) Tend sub


利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
! V5 _$ e% k! l- F, `修复方案：
修改函数！