SDCMS后台绕过直接进入漏洞

admin

要描述：

% b4 g- \  F9 }. V+ nSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
. I) C' q9 b8 D0 k5 N& G3 j详细说明：
Islogin //判断登录的方法

sub islogin()

8 E, V: x0 G6 |6 Bif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then
9 p  {& L" a' j) \( N9 E5 f
- H9 P6 u& N! v  V- edim t0,t1,t2
, O* }5 J8 f2 c
$ J$ l. {$ ?, t* Vt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
- ?0 m7 }8 B& Q
, j! d( m$ D8 A' K$ Lt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
3 ]; b2 H5 u8 ?7 h% ^' H3 n
4 J6 t+ @2 K$ p8 E. q0 |8 `if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
" P( k5 e9 A* Q
//

sdcms.go "login.asp?act=out"

2 j& {5 b/ y4 ^' A9 kexit sub

else

+ W! z) c6 U" b) {/ b0 Ydim data

data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

; j+ i& S0 J2 Isdcms.go "login.asp?act=out"
0 C  u4 z8 T; U3 I$ H
exit sub

else
, `6 G0 j  R0 K$ [& ?/ p# K* u  P
if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
) y* l# |- }* r0 J' i( m
exit sub

else

: Q3 g( H9 w$ t$ r$ D5 y8 iadminid=data(0,0)

adminname=data(1,0)

. H7 h4 o1 ~6 Uadmin_page_lever=data(5,0)

admin_cate_array=data(6,0)
( n* V1 U) Z8 R4 D" f) N+ c( V6 M0 R# P
admin_cate_lever=data(7,0)
1 u" m; H3 m* X' T1 A
9 W8 @8 |- b% H% Nif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
- Y! a" {1 Y9 h7 N! q* ~
  g1 c" ]3 B( w& g2 H+ hif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
/ R" W  e' K7 I2 \9 W5 N
  d+ H" @' i* v* Rif clng(admingroupid)<>0 then

4 l" U. R7 k3 L; Kadmin_lever_where=" and menuid in("&admin_page_lever&")"
8 [& e9 k0 e4 e7 X$ z6 a) c+ T+ W
end if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

- h/ C( _! f8 I" p3 o" s" j* R6 usdcms.setsession "admingroupid",data(4,0)
5 q; ?1 R3 G+ E$ y( z$ p
* y3 k7 M- Y! L" }2 g7 W* gend if
3 t& r  \! e  @: X5 D2 X
end if
. ?2 n5 o- P# C& @8 o
end if
& r2 K/ c' a' `* J# |( q7 H+ Q
% |  E1 H4 j$ d3 v2 l' E9 D: Qelse

9 r# L' a! U  Odata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
  |. M' S1 o* }/ c, g2 q* h
- R! I0 w+ I& X- [. g( pif ubound(data)<0 then
& N2 w# H, j1 R* Q/ d1 w
% _) r' Z" y% K/ k: A) c9 v, U: Nsdcms.go "login.asp?act=out"

exit sub

else
8 n7 f& o+ e# S( d! w
4 ~0 }9 v5 U! r" Y( [admin_page_lever=data(0,0)
6 \2 P. m$ l4 M) Q9 \8 N7 z
admin_cate_array=data(1,0)

admin_cate_lever=data(2,0)
: H# f: v# a8 s. S4 ?5 ?( [
1 }5 o0 F% V6 Y$ p6 Gif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
+ E5 Y, p) F: j! A( C& h8 l
$ \* v) X  q0 m: W; Q/ k# Fif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
* q$ g* v& d0 k3 c, s* g& v
if clng(admingroupid)<>0 then
1 T: ~. ]# |" L# p5 a
$ e2 O  y' c6 O: L+ N9 iadmin_lever_where=" and menuid in("&admin_page_lever&")"

end if
& l4 t) q% P; d  Y6 M) F/ D
end if
8 W8 V1 e% h* c1 [
' T( N2 \% B( {% ^3 J4 ~end if

! q- T+ T. b3 ?% fend sub
漏洞证明：
. m2 t8 G+ Y6 |6 S看看操作COOKIE的函数
, N( ^- Q+ h# q
public function loadcookie(t0)
3 T2 u- v; A+ k; \5 K
loadcookie=request.cookies(prefix&t0)
7 e$ u7 f2 d  T0 u3 y& l: I4 T8 \
end function
/ ]* a4 w( c' K
public sub setcookie(byval t0,byval t1)
! T5 ?% x( K* r; \9 v" q6 R0 [
response.cookies(prefix&t0)=t1
0 B6 y+ }" j2 y; _% _
end sub
/ E9 [% V$ B( H# f( L* u, \
prefix
' d; ~- v' a7 }- p1 a8 W5 t
'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
1 C+ G$ n& A" C
dim prefix
) q- X* {2 @2 E" w7 Z; A  H
prefix="1Jb8Ob"
! [% Y* V5 T! U: j6 w1 l; ]' B
' F/ }& c6 F6 ~. k& m'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

3 Z0 y# T+ o* s( w7 b* J, isub out

sdcms.setsession "adminid",""
0 t; f  h/ [$ _4 j) p7 Z! s
8 z( ]5 K5 Z+ ~: V8 esdcms.setsession "adminname",""
& A, e+ d0 }7 m' K
sdcms.setsession "admingroupid",""

* f, z5 v. t% D* Esdcms.setcookie "adminid",""
" U1 B7 G: h- J$ I  B5 W
sdcms.setcookie "loginkey",""
3 j' F- K8 A3 G# O; _" R) P% j/ P
sdcms.setcookie "islogin",""

) D% O0 j* A; U' Tsdcms.go "login.asp"
9 k* j& W+ C6 O1 n6 |! |& m
7 P: T3 U; o/ J7 m+ Pend sub

3 |- L# M9 |& L; C* @( ~% c
; F" B* B1 @% W+ v  L  I* E利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
$ F1 r( v( e& L2 G/ r  I修改函数！