SDCMS后台绕过直接进入漏洞

admin

要描述：

SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
+ t9 f$ Y# N( K- @6 J* A# u, d. f详细说明：
Islogin //判断登录的方法

) V' B. |3 F- T& R/ R( f/ xsub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2
  n) V* C  o1 \
1 U2 n( e7 x' O* L4 F2 _" tt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

% P, D# @* j" s2 Y  N9 L//
7 `. ]) j) l/ M' E2 ~  |( r. {* _
# j2 L" I" A/ w+ @sdcms.go "login.asp?act=out"

exit sub
( T  k3 G7 p& A6 c2 i4 J7 }  H5 V9 b
else
$ _: x/ N1 G9 z$ m
dim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
2 u: q9 `  {, K0 K+ v- Z6 z- t
if ubound(data)<0 then
$ |/ s& f1 O' {
( y& ]* Z& ^4 H  Z+ a: Psdcms.go "login.asp?act=out"

exit sub

else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
$ @* F6 \+ ~  A# B1 t
3 [3 v9 x" `! K$ s+ N( L4 Tsdcms.go "login.asp?act=out"
: k1 V2 Y3 i6 U% U% g
exit sub
# k  w% Y8 l0 G
% _. v7 j: t1 L/ V/ l2 j5 telse

adminid=data(0,0)
# f8 M0 ^1 I+ U; O
adminname=data(1,0)

' c, b0 {* ]6 Y& l& b% padmin_page_lever=data(5,0)

( m9 B5 _7 K: m2 c& m1 J% X3 Y. wadmin_cate_array=data(6,0)

( Y& `$ Y2 n, D% Q( \admin_cate_lever=data(7,0)
, h7 S$ a! X$ Z$ i# B4 E3 Z6 v3 V
0 T) Z# D) Q9 ^9 a- D- Pif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

% |$ a! G' m# n  W$ {if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
$ t" E% F6 G+ Z4 |* m/ @8 z
7 P# D- e7 M( g! X, p2 Hif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
& w; T2 e+ r+ s5 L/ V
; `$ M" |$ M- s& e0 L0 ]0 [admin_lever_where=" and menuid in("&admin_page_lever&")"
0 a& A/ K8 U5 p' i
end if
$ P) r3 F0 }% j8 t* C
sdcms.setsession "adminid",adminid

4 Y0 u- Y0 T# `1 \) Tsdcms.setsession "adminname",adminname
+ h" \1 p, P4 |9 o4 ]+ b
, n! m* V' b# ~8 tsdcms.setsession "admingroupid",data(4,0)
, l7 l8 a# ^. \3 L
end if
  ~8 K' X- k' ]5 P
4 S; I. Q% v1 u* j* gend if
4 H/ j$ {* D3 j' O/ g) H
' K5 n, O. _/ n, c, r% send if

else
) R6 G+ p) {2 Z. k/ Z- O0 j1 o
; Z+ B6 o9 W6 g  idata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
2 i. Y$ b9 H: @8 Y2 C' U
if ubound(data)<0 then

2 y2 n. |& S: csdcms.go "login.asp?act=out"
: H1 v8 ^# D/ r' H% \5 o
4 Z% w" w% y: \# R; Vexit sub

0 J" r4 I7 }- X5 F5 w* {% b, ielse
6 r% \/ T# [2 e- d) D3 H6 f1 u- y
admin_page_lever=data(0,0)
( D9 U& u- a; Q6 A
9 B2 F8 N  b" ?; ~, a" ?5 kadmin_cate_array=data(1,0)
' z. W- q2 R# z% ]* o9 ?3 F
: @/ e# i6 @5 V5 n9 ladmin_cate_lever=data(2,0)

0 W6 e" e( c9 w# U# ~if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

9 q8 ~: @( C0 ]2 p2 uif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
# ]% G4 J' U6 \0 o0 r
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

4 B7 a8 F' Q: C- _end if
( b1 ]' t& {9 P, f; }
8 {( u- g2 f: b; Bend if

end if
5 ], y9 {' a: n& [) h3 `2 H$ O
. k; u' k( f& V$ G# K* vend sub
* X, ~0 y( V8 M. P# m+ P漏洞证明：
看看操作COOKIE的函数

public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

end function

* O! f* M" v* Y% o( \4 apublic sub setcookie(byval t0,byval t1)
+ Y( Z2 A! b4 f- Q% R4 e8 c
+ O6 P' a3 x7 X! i8 u  }5 eresponse.cookies(prefix&t0)=t1
$ K" y2 p/ c8 K  ?. }
end sub
; H$ d: a0 E( ~* Y! {# V
prefix
2 n5 l. K0 d6 d
  A% i: N! J6 S2 S" P& F+ _'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
  L' P. h% w$ u
dim prefix
  b! h  \% l: G7 O7 g1 K6 c
$ l2 _/ O0 C; M/ }/ R8 `) J  Yprefix="1Jb8Ob"

'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里
& N7 A) W0 }! k$ X& N4 A
5 B5 b% S6 U  L/ f0 l! N- Ksub out

sdcms.setsession "adminid",""

sdcms.setsession "adminname",""

+ ?6 d% T1 A1 D; @5 @5 ssdcms.setsession "admingroupid",""

4 F; R8 m3 ~3 k6 b( u8 ~: ysdcms.setcookie "adminid",""
8 v2 A* d) I: t% ]& {. x" N
. A$ v' |! d5 f/ ~% d7 p- {9 G3 ?sdcms.setcookie "loginkey",""
7 p/ |+ q5 V1 G; J/ G
. B3 D' p6 c- S7 E+ H  B; nsdcms.setcookie "islogin",""

4 L, @0 u+ v' F& @+ Hsdcms.go "login.asp"
# d' d  [7 u% r  R; P5 J+ w$ Q$ u
end sub

( j5 g/ j& J9 _# O1 m2 n
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
# M7 z! G) L- j& |1 w8 g修复方案：
# S7 c, Z$ `3 b3 v" L6 R修改函数！