SDCMS后台绕过直接进入漏洞

admin

要描述：
9 f+ H0 U. i$ o7 n  e
6 R2 ~1 }# q) S3 R0 s$ }* ~  LSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法
# f+ [. j! w. Z2 c; W0 S7 V
sub islogin()

$ B1 ^: y. h2 @, Qif sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

* @, _! V% t" n: P3 Y2 E# R+ Et0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
3 ^6 z! f/ {  [$ J
9 A6 s% w. c; r" ?* a8 r1 St1=sdcms.loadcookie("islogin")
7 j, W; Q+ w' d5 Y" w/ @1 K
# L$ g% H7 j# z* dt2=sdcms.loadcookie("loginkey")

3 T2 F2 m: k' A1 \$ B. y: }if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
; ~9 F* f8 @/ d6 h! S
3 X4 q0 S! i: ~: {. h//

' U& e9 f) ^! m1 A. k' K% V! }8 ^sdcms.go "login.asp?act=out"
5 D! p9 O4 x' ?2 A0 \
exit sub

! c3 p* k) ~( ?9 C' nelse

dim data

$ V0 u8 d' I9 D. j9 a8 `  U- ]+ Idata=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控

if ubound(data)<0 then

! Q  R0 p8 A/ b. f5 P# ~- Lsdcms.go "login.asp?act=out"

exit sub
. o" R/ M* C! {% k
2 V- j" U, T. |3 k3 {8 K# ^else

if instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
2 S! O2 Y" H9 U
0 u, e$ b* J1 W0 I, Dexit sub
! O% t. [0 ]4 E0 V/ @+ u, W
else

  k' N& ?2 X! Z; `6 `1 _adminid=data(0,0)
  v" ]: a  m: z4 f3 p7 ^
6 d7 }, `4 E6 g. l/ E+ Nadminname=data(1,0)

2 Z7 e9 r" L' l: p  s1 x8 Jadmin_page_lever=data(5,0)
" _, Z4 P& ^- w+ d" w: _) v* i
admin_cate_array=data(6,0)

admin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
6 e' e# o2 ?5 o3 X3 ^
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

; G) E# H; L1 Cif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

4 y/ z! C( ^8 I6 Q& m& b7 d$ Y" A9 rif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"

3 @9 J" [" L9 B/ D6 Kend if
) C7 o) z' X% C7 P/ I7 |- B
sdcms.setsession "adminid",adminid

4 G' r2 x- I3 g6 B- f! s6 k- R& Csdcms.setsession "adminname",adminname
& ^" Y8 l0 m5 k( @: r2 e% u4 A
$ z+ M4 _( i9 H- u1 ]7 |+ r0 @( [sdcms.setsession "admingroupid",data(4,0)
7 T4 D5 ]8 ~( J1 F
end if

end if
1 @  j8 {* j! A5 S% s2 ?
% S1 X  U6 f) t: p1 nend if

+ @& c' l  e. a" V" P) F  G& A9 S9 welse
0 U& L6 L( C% U
$ m5 u+ K% B* b( y1 I7 wdata=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")
+ _5 A& Q! G1 v& L6 y3 Z& Y
4 l$ J8 ]. R& wif ubound(data)<0 then

6 @2 h7 S) S+ c' Osdcms.go "login.asp?act=out"

' ~0 I/ L$ k0 V4 Wexit sub

else

/ u- r" J  I6 K1 o" d7 I0 oadmin_page_lever=data(0,0)

2 A9 ^! g3 i7 V: O7 eadmin_cate_array=data(1,0)
. @& \* ?  s5 t$ W
- L2 \  K$ H& J( Q7 G5 eadmin_cate_lever=data(2,0)
7 e* H& l# z- }' a+ D3 s
if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
1 i6 a4 I' \5 j2 A
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
- w+ \% h( T9 q; y3 I0 x
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

4 J+ @0 M+ V8 V1 fif clng(admingroupid)<>0 then

0 ~: U/ ^. W  P2 d0 e; s0 Aadmin_lever_where=" and menuid in("&admin_page_lever&")"

4 Q; F& z5 d& A% D2 _& T& ^. Oend if

+ x2 P1 m9 C* O2 |; s5 o# f. ~end if
4 R( q0 f6 o. \8 J
end if
. j) m$ G6 X8 V+ `
$ z7 \$ F+ j! G  F% O' p7 C& Lend sub
5 a7 G" g9 x5 O2 V# H: j漏洞证明：
看看操作COOKIE的函数
+ l6 v; q' U9 A2 q6 |6 I- z; s
5 k4 a; B3 ]1 R& ^* ?$ V0 M$ ]! Cpublic function loadcookie(t0)
4 }. m+ Y1 l8 T  o/ m- J5 N* h4 D% p
loadcookie=request.cookies(prefix&t0)
; p( }# s: C8 O4 c6 R; i
end function

public sub setcookie(byval t0,byval t1)
! N, E" v2 r$ v5 i& N* G
response.cookies(prefix&t0)=t1
% |% b2 r/ b8 b/ j6 }" A5 J
2 b8 F/ R9 x$ z1 Pend sub

prefix

. o) ~$ p& l+ W* p'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
6 L' |/ p0 H8 y& S8 B* F# Z+ Y
dim prefix
" D) p, [4 x+ {7 l. n1 g" |) H) }
prefix="1Jb8Ob"
, \- C* e) }8 C/ B8 y
# v& h( ?. x0 K'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out

* ]6 k% Y- ]- P: o+ U9 l' osdcms.setsession "adminid",""
0 K5 y$ h9 O1 p2 i/ `
sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
* l2 J% j$ i) s3 y
/ t4 y9 d; C3 T$ L( w/ o6 d. D% p" fsdcms.setcookie "adminid",""
& S: U3 z, v& z, J+ g! g) F3 b
sdcms.setcookie "loginkey",""

& f! J& K3 ]8 V( K5 R1 B5 dsdcms.setcookie "islogin",""
5 t! q. P/ P2 F( b: z, H
sdcms.go "login.asp"

end sub


1 W% h9 D+ {5 n% E' o1 z' q* {: S利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
修复方案：
修改函数！