SDCMS后台绕过直接进入漏洞

admin

要描述：

+ H; ?: Q: H1 x) U* q- w$ [SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
5 x5 C! a, L0 @6 ~9 `/ q详细说明：
* L( Y% _/ L' [6 i  tIslogin //判断登录的方法
3 q4 Q0 ?7 w8 s9 i, A) x
sub islogin()
# L" {) n; a0 V
; ~8 r8 k4 o! b: k1 {/ T% \* X8 nif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

! \/ I5 B+ J  J2 ~, qdim t0,t1,t2
# q" C# J' K8 E) x
t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
( E# t4 ~3 Z3 k- n7 K! R
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
1 F' `5 w* L$ d
//
% m8 e* W' y: S4 l: F
sdcms.go "login.asp?act=out"
8 ~2 w8 O! |' t" {4 u
exit sub

else

dim data
7 ]* m! o7 \# X+ n8 r
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then
, f& C) e0 x% d' u
5 P& F  j- j; q3 j! `! C' `+ L: Ksdcms.go "login.asp?act=out"

) X* A1 F% K2 y8 e5 g. S0 Pexit sub
- i0 c' D2 p' @! \$ [9 W
else
3 K+ O1 F, Q9 w+ ^' S7 q( {$ _2 \
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
6 {+ r) S( c' X
exit sub
; I' u# G4 a7 v- V' d+ E
2 I$ O9 n9 I2 {' P5 Y( a2 ]else

( m' b' S9 W. D8 E5 Ladminid=data(0,0)

/ b- N; ?* p0 r3 `* o# @6 Eadminname=data(1,0)

6 g, u& b. o: o1 G  [3 ]- madmin_page_lever=data(5,0)

admin_cate_array=data(6,0)
- j) d! H6 k3 l% K! l( m
admin_cate_lever=data(7,0)
6 c' Q! G- T$ Y, f0 v9 p8 i/ @
2 `8 J# J0 O- E  {( pif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
4 S7 Y; M5 {/ v. }) a2 b4 I
+ z' i' G' a/ u- D# A5 vif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
, Z7 @0 k! z4 O8 E2 H- F* G
! n: r8 R! E4 x8 Sif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
6 u9 P; Q7 u% x; H  y
if clng(admingroupid)<>0 then

+ ^" @# }* x9 _  f4 c6 Xadmin_lever_where=" and menuid in("&admin_page_lever&")"
  X8 ^9 d% t' k$ h- N7 V7 e
end if

; Y; s3 b) V" r6 Y. V/ }3 Osdcms.setsession "adminid",adminid
7 N, t8 @  w8 y9 w7 c
sdcms.setsession "adminname",adminname

sdcms.setsession "admingroupid",data(4,0)

6 g( |9 y! w$ ^" A0 M! ~end if
4 t8 n2 d, ?+ x9 s/ \
7 l' M: h: V; U9 Vend if
) K) Q7 U4 _6 z6 G
; K: K8 M6 m! v8 y" Hend if

9 I6 ]8 I, g7 L" J7 e/ {else

8 t  Z' Q% Q/ E1 t4 edata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
6 M2 ~+ ^' }) o
! U2 ^# Q; O  o* a) {$ Q0 Cif ubound(data)<0 then
- j( y( H" I3 i$ a
$ r& i, d7 e- U1 qsdcms.go "login.asp?act=out"

exit sub

: D! `+ |' x5 Z9 A- kelse
% r. t, Q0 B6 ~& x' A
7 e$ B* x! L' }  x0 \/ sadmin_page_lever=data(0,0)
  y, k/ w2 ]: k/ U
$ o3 u- v: Q; {8 badmin_cate_array=data(1,0)
; n& l3 V6 P/ t8 S5 a. ?3 E1 u1 J
admin_cate_lever=data(2,0)
# ~9 _' P1 J" R, b) @
, R) R1 W5 B; N2 R) k, E- `if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
- t4 c& L: R5 h2 V
' b5 C$ W* {5 H1 zif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
  l+ c' W# @3 o" ]3 T/ _4 I
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
* I% D# L2 \& q8 [- t
4 b/ `; S$ b6 ~2 M; }; Lif clng(admingroupid)<>0 then

4 P  U4 y6 [' P4 a  fadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if
5 t4 ^! }7 |' g4 H% i3 j- v
- N. A& ~7 B7 D% yend if
) \) |- v7 L6 E4 t% C" ?$ @$ s* R' o; g
, A2 O; R. ], l  k$ s8 xend if

end sub
% U1 s, I' m% h/ a漏洞证明：
看看操作COOKIE的函数
: ^" L  Z; q. K* L# w; Y4 u$ {( j
# i& P4 t( }: \public function loadcookie(t0)
( M( O; \3 R! a  I) x0 P
loadcookie=request.cookies(prefix&t0)

1 @2 e- s; c/ t7 u; G2 vend function

- X/ a8 \, Y. O' p* Wpublic sub setcookie(byval t0,byval t1)
5 P0 N, `8 R( I; g0 t
response.cookies(prefix&t0)=t1

end sub

5 m  J6 I7 {) U$ N' z& kprefix
9 q  K) }- s4 ]8 L2 D, h. ]
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

  d) B2 f5 i1 ndim prefix
& \. y: w0 ]' Z0 A" J9 b6 @* _  I
prefix="1Jb8Ob"
; J' d1 Q! w# Q, T
: D3 q$ f/ V6 ~2 P7 n1 U* T'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

4 M# }; |* q* A- o$ xsub out
4 Z" H" O2 B, Q- Q5 \, t: E2 w- @
sdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""

( F' f* I& N. j( }" s$ |0 C" Hsdcms.setcookie "adminid",""

0 Y/ k0 L2 m6 X8 x, qsdcms.setcookie "loginkey",""

0 f& v! b: y( C: ]9 Bsdcms.setcookie "islogin",""
* V1 B* q+ d' n- v! Q3 p
" x) g0 Q/ z. X/ s) ksdcms.go "login.asp"

2 K1 k' n7 a' w: L8 H/ Q9 A. gend sub

  G5 [. b% r8 b, P' i8 V0 L+ O' u
4 ]: S( M3 ^0 a  w利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
$ ?% N" v- M; G& m8 a修复方案：
5 H" `: d: w( R3 r1 S! y% ~1 c修改函数！