SDCMS后台绕过直接进入漏洞

admin

要描述：

, b3 _( w: ~7 D$ U; E* pSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
, r% ~5 Q7 c# W: E详细说明：
Islogin //判断登录的方法
$ [) S& _& B) O
* c+ T1 v% g: ^2 ^8 gsub islogin()

5 L: F3 \# l+ f; W( Yif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
6 z8 S- d% s0 E$ @- A9 l
dim t0,t1,t2
4 F2 ^3 |, P5 Q
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

" }+ [& ]  m' dt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

! A' p5 s4 d- j" ^* J5 x4 }0 o) ]if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

3 k& K$ s7 `; C1 j; W. d//

sdcms.go "login.asp?act=out"
6 `( P( m* G! e. D
: y9 v& v) F+ [6 v+ L$ e2 R, O, Nexit sub
8 F: N- U" d' b3 N" n
else
: @' E& t  N/ Y5 `: S/ d
& [1 x: D0 O% O2 ndim data
- r2 f" j: T! x* [- a) b8 K
6 x' }2 L: ?* X2 ^/ Zdata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
' n1 W5 V; P3 ^3 @
if ubound(data)<0 then
  u) l* w. c- o; C
sdcms.go "login.asp?act=out"

exit sub

: n: }5 {6 j: W. `- n& Q. ]else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
/ Z6 q. n: U1 U1 s) o
# ?; y# t# i+ t, n6 O9 s; xsdcms.go "login.asp?act=out"

exit sub
# ~+ O2 Z. |; d3 B& _; A+ O# }6 w
else

adminid=data(0,0)

) I' {. y% w3 l# _# o( o  Yadminname=data(1,0)
& L  o8 G9 N% u) A6 [4 |
( T6 b4 l$ v% y$ v/ f# A+ l% hadmin_page_lever=data(5,0)
( n, |& P. Q" G
2 v* ^! g  f9 x: T' P/ kadmin_cate_array=data(6,0)
5 t- v$ l! S# ~" |8 F7 m6 E
admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
( j- ~& Z. o3 |. N( G. x" `
0 T9 ~( e7 X; G7 r. |if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
2 u1 T1 ?* z  }
3 M. N$ \& D8 D$ Iif clng(admingroupid)<>0 then
0 P5 M& d2 n- N3 {- e% \3 @2 I
admin_lever_where=" and menuid in("&admin_page_lever&")"

end if

sdcms.setsession "adminid",adminid
, `; W- s$ \/ Z  }5 f, K
- O$ a) Y2 |6 _; E9 D3 ]& Dsdcms.setsession "adminname",adminname
# `4 _' f+ }& w) r) i
sdcms.setsession "admingroupid",data(4,0)
: k3 L7 m1 V& F; c( ^
. r* R. |! K/ T! }end if
2 C) `; J' J3 R' Y7 E  I' g, ]" F. v
end if
2 s3 b7 V/ W5 i5 L1 O, i- t
* ?( w# q. t4 C" Oend if

  _7 P5 ^2 I1 B' B( }( m6 v5 celse

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
& U- i9 J, {' K! K
0 m9 j7 i5 P$ X& e% h/ Bif ubound(data)<0 then

! d4 }0 \& [  v. z* B. I9 bsdcms.go "login.asp?act=out"

3 U( L( A* B5 v  v9 Uexit sub
% E, k: u9 b. w# `; R7 Y  P$ i- Q: L
else

admin_page_lever=data(0,0)
0 y/ Y4 P2 I' ~; B- d7 t8 C6 m7 Y6 W
, c8 C' y% B: H2 t4 ~admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)
9 v% q7 D6 D# L# O/ l
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ f3 P) X9 |) R. V' h& P
: ^! p9 J" x0 ~' b- O+ {' g; ^" Iif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
, P+ ^) u6 I2 E" N% e& S
, ]2 x! _. G9 c* j( Yif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
% [  q8 M4 U2 c+ E" y+ g& z
if clng(admingroupid)<>0 then

4 n5 ^" U; T$ T6 o0 m* `6 Yadmin_lever_where=" and menuid in("&admin_page_lever&")"
! Y0 |" X; T7 x/ r& e# D8 j
) S3 U% s+ f' e* L0 `end if
% z7 P# A# F# W: O* ~8 b4 q
end if

end if

' V# M0 {5 K8 ?' \1 U* Z( m& t' Mend sub
$ M* S: J& V$ t6 g8 {& N! H' d漏洞证明：
8 x: P8 c3 Z/ B) w看看操作COOKIE的函数
& Q' A4 R8 C: \7 y: f" z* v- h
public function loadcookie(t0)

loadcookie=request.cookies(prefix&t0)
" M6 n( c/ g  J1 I
end function
) O- {, d% }" t; k
' S: r3 k7 p7 R2 W6 b. jpublic sub setcookie(byval t0,byval t1)

% y8 ^1 X8 J# e/ ]( i- B8 Hresponse.cookies(prefix&t0)=t1

end sub
0 B9 Q7 Y  v% s9 {* `7 }# k
$ R# `' b" B" D3 j3 |prefix
- J- z) ^/ H- I& w' p1 X
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
; \7 y$ i1 [7 N; x( u  F* g; z
; n' N6 Q' t+ r3 Ndim prefix

prefix="1Jb8Ob"
% G1 a+ j# C( k1 }7 p+ w( ]/ U
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

1 ]' w3 w9 T% U% Rsub out

5 j* C" O; {3 z6 E' asdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
$ N9 U% q7 @+ w6 k$ |3 X. [& m# M
sdcms.setcookie "adminid",""

9 K+ R" h& [5 ysdcms.setcookie "loginkey",""
# C8 l' j# V' Y( \0 Q9 `! }# v" g
sdcms.setcookie "islogin",""
6 I" _! ]0 n7 v5 w2 }1 Y
- ~, O9 W2 a; Wsdcms.go "login.asp"

" }7 y) L8 c# J! I) }. aend sub
/ x. k" S) Q3 Q

4 ]8 m4 R9 m% R5 u6 _9 I0 G利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
, M7 h- b/ w, r% E# {  j, s修改函数！