SDCMS后台绕过直接进入漏洞

admin

要描述：
* I4 v6 g8 A! `# f9 L, z
3 C+ v+ |5 G* `; {  W: mSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

sub islogin()
+ ~& B; l4 |2 k
; j) s2 `( `/ u( _: L, tif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
% T1 O% h; A  k6 d5 L& n
dim t0,t1,t2
2 c, _- T) L$ G) Q* x; X0 V9 q; Q3 C( P
" v3 `* M3 t6 T: X4 W: A( ]t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")
, n# H- I5 H" j: h5 {4 H) ?
t2=sdcms.loadcookie("loginkey")

' g9 @1 [7 u* {& `if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

" b" k* b; d8 E//
- ?) a! M! S" Y' \+ m4 Y3 g% A
sdcms.go "login.asp?act=out"

exit sub

else
9 m$ H  X; H$ l* ?
/ c2 ^) i: r4 Z# _dim data
7 k* V- W. E- F) y; T7 Y# \9 ?  p! |
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

" S+ Y  a7 f4 B9 c# ]4 x; l, q, z# Isdcms.go "login.asp?act=out"

exit sub

" k. X) t1 \% B: V) y. Selse
8 e8 |( A; u" M1 k* G
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

) J% F* X4 L) l9 d8 J. {) r/ dsdcms.go "login.asp?act=out"

exit sub
! d7 L0 k% ^" S; m2 d
; |4 \1 W% [& R7 M( k, |1 [else
# E9 A7 Z' O7 z* B0 u/ H) K
" M. b- F4 ~$ Y4 h6 f! j; Vadminid=data(0,0)
0 }5 P3 s1 v$ {8 L9 P! c
. p: _) f# m1 p0 k, G1 t" h3 ~adminname=data(1,0)

; d. [* I5 {, [0 w" zadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)

3 h6 g8 Z: h. H  Iadmin_cate_lever=data(7,0)
% w) ]% k  q& g" q1 s+ k6 r, @* h
, s* O6 r, R8 U! D# }0 L; Hif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

5 l9 @8 `7 I9 e- `if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

" E  e3 l2 e4 g* r6 U3 P6 l0 e/ I7 ?$ Dif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

* c' R7 u% p2 K* T; oif clng(admingroupid)<>0 then
: x; [: e9 j1 V, ~8 e6 T2 x
6 s! p& m( a% \: q2 Uadmin_lever_where=" and menuid in("&admin_page_lever&")"
; |% S. T4 h, ^
end if

sdcms.setsession "adminid",adminid
; E+ P% g7 E5 ]
sdcms.setsession "adminname",adminname
5 t! k: l3 `% U# W( W$ ^7 g
sdcms.setsession "admingroupid",data(4,0)

end if
" u" J, P4 _8 h
  Y5 J) z2 i% P6 W1 X( Y5 Nend if
, G( Y; F3 ^9 j6 F  i
+ T& `3 \! h2 Z( a" E$ Pend if

/ u8 K( b/ m, s* Ielse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
! P. R# M' U% b! N
& q; m; }: |1 M" O: I, o! }sdcms.go "login.asp?act=out"
  ~0 U! f  Y1 V1 y9 e
8 |  m3 J% r: C5 Oexit sub

; ?' u4 |$ ~5 h4 V- b2 Pelse
6 d, _1 n) I! g: z7 B+ F
admin_page_lever=data(0,0)

. ~* M3 v! x4 ^( uadmin_cate_array=data(1,0)
1 h0 w! M; O: ^# a2 p  X
admin_cate_lever=data(2,0)

" o  @: U" y7 ~) n" Iif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
9 ~# m6 ]" p) z0 y& c
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

/ d% i1 w% X% t/ d" Aif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
. ]! Q* r% D8 |3 H
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
, W* d5 h: J7 C4 J1 M. c  h1 `% O  B
end if
- q$ C* l9 {8 P) b7 m$ h
end if
' b. E- e7 b6 u
end if
* C+ D* F0 r" O
end sub
漏洞证明：
: J: D- D$ S5 V" d; G9 r# ~3 X$ m看看操作COOKIE的函数
# e( Z. U2 p, }' `2 F6 q% ?
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)

9 L: `9 d# l; d0 u4 X2 x. bend function
! ^1 f/ I6 c- Y! A
  ^2 W( Q0 K% S, M, Y- u% @public sub setcookie(byval t0,byval t1)

) m' H+ I2 L; T" I6 n8 N  g6 _response.cookies(prefix&t0)=t1

& r' e9 y) q4 Z9 \1 y; u2 K3 Nend sub

5 d% ^$ N. l$ m! R, `prefix
4 A8 `" G0 r% q6 J( U
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
. E7 M' g9 h9 X% e
dim prefix

prefix="1Jb8Ob"

) s) Q# `' ]% X# o; |'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

' P  a; M+ S) ?8 x$ b- fsub out
3 w0 e+ w" Z% C+ C% B( g
sdcms.setsession "adminid",""
( r  D% N3 g/ E! d+ D; Y" ^9 w
sdcms.setsession "adminname",""

- H2 r' X( y" Xsdcms.setsession "admingroupid",""

) r2 Y! q5 f8 A) B" J; ]6 |$ asdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
+ j( s7 u( z' E1 }$ v( l
sdcms.setcookie "islogin",""
0 D  B6 @: o9 c/ }, u
# c' \1 ]) ~1 W- u5 jsdcms.go "login.asp"

  ?/ w+ W: k- p3 c! u- q8 S4 D6 jend sub
. d& y3 b* V! v0 U' J& H7 J

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
6 ]- y) T( u; C1 C% r修复方案：
修改函数！