SDCMS后台绕过直接进入漏洞

admin

要描述：
+ b5 a& M7 h3 o3 t, J9 J. ~0 K
( D/ y, T3 Y- ESDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
! G5 J5 C# L  x9 X0 V4 y/ x详细说明：
1 Q9 I9 O: |2 t" Q5 AIslogin //判断登录的方法

6 m# Q! \6 d2 dsub islogin()

if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

" n' z$ {4 @; ?2 g* Ut0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
1 M0 ^, U6 a1 H3 q6 R
4 J1 D# V3 h3 }$ Nt1=sdcms.loadcookie("islogin")
  u& c9 t% ~# h+ P" q3 n/ D
0 r* K' b2 l6 p$ [0 z/ Xt2=sdcms.loadcookie("loginkey")

if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

//
0 [5 {5 t; n! j, o
sdcms.go "login.asp?act=out"
6 N8 d/ p- j5 \9 `
exit sub

* P6 }4 a( E: r. A% h2 f) Velse
' }: \; O$ G% J6 }8 i6 g$ I
$ K/ t6 B1 m5 {1 p4 [$ U9 Xdim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

  o' P6 _7 g2 H  m4 \0 N, oif ubound(data)<0 then

sdcms.go "login.asp?act=out"

exit sub
7 n0 I# z3 t+ I/ Z+ y
) j$ r* @( Z5 O6 L# Eelse

$ U! U& f- w# V, Y" l/ kif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
) ]) z* p$ v5 U; H1 M7 T3 u& b: y
+ i$ r- ?. ]$ O, Xsdcms.go "login.asp?act=out"
  ]1 Q* R7 E1 v; I: |3 w+ R
+ y% C" O. D& l" bexit sub
; P+ n: }- N4 H7 T7 x2 g, N/ b
else

2 F+ Y3 a! d5 d2 vadminid=data(0,0)

adminname=data(1,0)

admin_page_lever=data(5,0)
  |: v0 l$ e% C; G
' S! t* J) i7 M, [admin_cate_array=data(6,0)
8 H, j5 D$ f( g8 s. D
admin_cate_lever=data(7,0)
8 V, ?6 Z% H! K4 v8 d
9 p; K' n5 H% f/ o8 |if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

2 t! v' ], M/ }: c( hif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then

9 P. e5 K# f- \0 \2 ?$ P3 V' Cadmin_lever_where=" and menuid in("&admin_page_lever&")"
" Q" P& ^5 G, ^  S* Y/ b
3 n: K& p5 {& u' Z5 Bend if
4 b& I3 I+ m1 D
sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname
2 R$ j8 d; M6 V1 O& q& w
+ M% q* H  m/ v. D9 l5 Nsdcms.setsession "admingroupid",data(4,0)

end if
/ e0 A$ `- c3 A  h( M" h
& o1 w: p, |7 A( ^. n5 F# Gend if
0 a; w1 T- }4 v$ J+ G3 Q8 y" l
end if

else
1 E( h  ^  w* X/ k* a  J. F
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
0 b) p  F3 p8 Z8 |1 L
if ubound(data)<0 then
, r6 W, L0 o. q4 d2 R" L9 H
sdcms.go "login.asp?act=out"

exit sub

else

) _6 Z; s7 Q+ Z: G' H. uadmin_page_lever=data(0,0)
6 o( Y: C/ L9 u: a6 `
8 ~  w7 H2 H3 j5 f& S; Hadmin_cate_array=data(1,0)
) L6 w& N* P7 G5 X1 E3 t; }% \( f
admin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
' n. L5 A4 k( j4 [! L
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
( G3 Z  n# ?) K2 Z; p, E
if clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
, Q" J$ a% Y, e  K  X
end if

  {8 Q* o: i9 k, F* {6 ]/ L  yend if
# j9 H0 u; K, T& H: N- V
9 m: i: j2 Z% Dend if
5 T% b6 I3 U6 H* h0 F7 w2 i
. L5 ?- `' y( ]/ ]$ y- Iend sub
  p% c: o4 T( _+ }漏洞证明：
看看操作COOKIE的函数
' M% Q6 [' c4 W; A! f; l
7 D% W0 A  r3 v  j$ o, U4 `% opublic function loadcookie(t0)

5 {, G/ V3 f+ f( T& j, Zloadcookie=request.cookies(prefix&t0)
1 x( s6 T2 |# y+ t1 K' H
end function

% k  ^1 V8 q/ M+ f% ?: rpublic sub setcookie(byval t0,byval t1)

3 k; v& |  F! H( ?response.cookies(prefix&t0)=t1

end sub

prefix
' F6 A4 `; o$ O6 P* d: F* _, F
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

9 v$ ^- E6 ^5 F  U3 I9 n) ?: Vdim prefix

3 M, C0 ], @3 _7 a" oprefix="1Jb8Ob"
8 g9 a. b6 b& s% C4 y/ L& r
'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

" X, W, a4 D" @" v. \2 _6 t; }sub out

- [. @# O: q- o2 T' s2 ~sdcms.setsession "adminid",""

sdcms.setsession "adminname",""
) |- V% u+ I9 @8 S- N( w5 b
, X% f8 K; Y6 C! {, R8 R8 Esdcms.setsession "admingroupid",""
6 c) I- m3 ~) N* J) D
2 R; h% c8 j2 i0 a$ n# }: Tsdcms.setcookie "adminid",""
) e7 p/ t& K" ~" i! x# o
sdcms.setcookie "loginkey",""

1 h, m5 d0 r7 {# n- S) {8 H" Y9 bsdcms.setcookie "islogin",""

) m' ?: A+ m! v# [0 G3 vsdcms.go "login.asp"

end sub
% b  s2 n9 g' S6 Q% l1 r& b
4 c8 z# ~5 v6 H
利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
+ P# B: j' H3 ~  x* a3 H修改函数！
1 D8 d$ ^$ E% L8 h0 W# w