SDCMS后台绕过直接进入漏洞

admin

要描述：

# N  _  i! k* r' Y, J* {* Z+ T- KSDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
详细说明：
Islogin //判断登录的方法

3 @4 `6 c. n" E" @% x' a) I0 nsub islogin()
/ V/ y' Y6 X% o, j
if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

# I1 H: h8 G) G6 ~dim t0,t1,t2

t0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie
2 N: `5 s3 N7 C7 D3 ]1 D  g
2 C! o* Z0 ^% t# wt1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")

. E9 [. z# k; s" {: B4 z3 pif sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行
% e9 `/ R3 @2 \# p# a- f
4 Y, B6 l# B8 z. v) C  }9 \//
! b2 V; b1 H0 E$ V
sdcms.go "login.asp?act=out"

# x5 P: q2 N, }, E! c3 Jexit sub

else

dim data
3 x) \3 {2 h! }) b% M
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
8 \8 e  ~8 o: v1 [
4 A/ j3 j0 Q- T- K- {% I& Hif ubound(data)<0 then
  L& I) x. J6 Z: {
* o' `3 d3 v9 ]; c$ h! [5 d0 c/ Fsdcms.go "login.asp?act=out"
" D' r$ V) R+ y: K& F. z* ]7 |. k
exit sub
: C9 M1 \- t; U* v
- p9 {& _6 }: U8 _4 y9 relse

2 K- D0 X9 w0 v6 [8 X/ ^, M; Dif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then

sdcms.go "login.asp?act=out"
. q& w+ Q0 f2 F: L
/ g1 d  K9 G  y# ~5 R% I, Aexit sub

else
/ P% H8 q9 H9 ~4 c+ r, Q
- k' d& K0 V  O' r0 `' ]: Y8 kadminid=data(0,0)

adminname=data(1,0)
  k) M. W0 g8 ]2 M  j$ t; |* m
admin_page_lever=data(5,0)

admin_cate_array=data(6,0)
; W9 W/ k0 a' g$ h* y$ @
+ \' W& S* {* L% madmin_cate_lever=data(7,0)
! X0 y. o3 D5 J% Z2 W
6 D* L6 w; b6 N; mif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
) V( C) z3 [+ o/ v3 ~% U4 ?! @
if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
  q) q" z+ X" f' b, b& k, W) Z2 P
. ]1 R9 y8 ^  v  l; Xif sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

+ O2 d2 G7 z+ M' D+ y! U3 wif clng(admingroupid)<>0 then

admin_lever_where=" and menuid in("&admin_page_lever&")"
! W# z+ [, j8 Y# d
7 N( D2 S. R$ mend if
  M, @1 n' S3 R
sdcms.setsession "adminid",adminid
1 A0 {) k. ]; b3 ~, P% ^3 \
; V( _) R9 w3 G' p# ysdcms.setsession "adminname",adminname
. M/ Z* Y2 V, K5 P
sdcms.setsession "admingroupid",data(4,0)
5 z$ u& B% ?% ~: B; f+ s. ]
end if
8 _3 |7 i" y- L' q: s  ^# d/ e( ~
end if
1 ]" U# v+ p8 @  w: |+ p1 o" G
end if
" g. n2 T2 Y  I
else

data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
8 Q) H4 S% ~+ t( f" G: i
" y9 N8 f/ {6 A$ h% {8 e" E; @sdcms.go "login.asp?act=out"

exit sub
) I, I0 q) R6 |, e6 U
& d! s1 A1 \+ R; ?% o, R. delse

; O, d9 W" Z8 A* p  \admin_page_lever=data(0,0)
8 ^& d. e& S: `' ~
admin_cate_array=data(1,0)
2 _6 A  s& b/ \# o
admin_cate_lever=data(2,0)

! j; n: L: O3 R% Wif sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

if sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
$ d8 o; K- x9 e3 M- }+ t* e
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

! w' e& t" `  c8 k  y1 B! xif clng(admingroupid)<>0 then

. ]! O  Q6 r0 j$ o& Z3 madmin_lever_where=" and menuid in("&admin_page_lever&")"

4 Z5 D# P7 t: X" t8 ]+ F$ d# Y  o# n4 {$ iend if

* u+ y! T- t1 X7 e) f, Qend if

. w4 m0 ?5 X" o  a3 V( b4 C! nend if
, x1 L  f8 L( `; n
end sub
漏洞证明：
看看操作COOKIE的函数
4 ~1 ?; t# F" W8 [) N
public function loadcookie(t0)
/ H7 A6 O7 P1 Z. r, ]) j
' ^0 M9 g3 ~) m- ~6 Yloadcookie=request.cookies(prefix&t0)

/ k; w; D# \3 Oend function
* w" k7 q4 |5 `
( S7 c2 H' ]' B/ {% L: q( t5 {" ]7 }public sub setcookie(byval t0,byval t1)
9 B; ?7 D# w3 C$ Q: f( v% P/ o6 e
* r6 \/ U" ?7 ^3 g; V" Z$ }response.cookies(prefix&t0)=t1

end sub

prefix

'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值

dim prefix
8 K7 _; v, v: o
prefix="1Jb8Ob"

/ T" Z/ R" E# p* _'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

sub out
% q7 B; w, ^2 ~0 B, I9 \1 z, p
- p! q3 \  e8 j% k8 z& Bsdcms.setsession "adminid",""

sdcms.setsession "adminname",""

sdcms.setsession "admingroupid",""
; N5 S' t! l! K. R) H( W8 d
sdcms.setcookie "adminid",""

sdcms.setcookie "loginkey",""
" ]5 I! Z9 z: ]  Z. ^0 M
sdcms.setcookie "islogin",""
. b3 C$ }' T4 Y0 E7 l8 U
* ~# j' a9 `$ h) u) _7 p8 isdcms.go "login.asp"
$ h8 _# ~6 M) }8 t/ G
- y* u$ `: o, wend sub


4 k. n  b( F0 ?3 C# Z# E4 R利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
1 b4 K$ s+ ], H5 i* x) v+ D3 h# ?修复方案：
修改函数！
/ K  ]2 p% q" F  Z6 U