SDCMS后台绕过直接进入漏洞

admin

要描述：
) Z7 P+ a* q1 I; s' h2 Z% L8 y
: m% D7 q" P: R4 o% q6 s/ k3 I5 ?SDCMS后台绕过直接进入：测试版本2.0 beta2 其他版本未测试
. f5 |  K$ _8 ?0 f) w详细说明：
Islogin //判断登录的方法

sub islogin()

  k' i* x1 B7 [if sdcms.strlen(adminid)=0 or sdcms.strlen(adminname)=0 then

dim t0,t1,t2

+ L9 X9 C3 I7 g7 q$ Mt0=sdcms.getint(sdcms.loadcookie("adminid"),0) loadcookie

t1=sdcms.loadcookie("islogin")

t2=sdcms.loadcookie("loginkey")
; D% v" W& ?3 U$ D2 u. |) \8 \3 V% K
if sdcms.strlen(t0)=0 or sdcms.strlen(t1)=0 or sdcms.strlen(t2)<>50 then //这里判断很坑爹 sdcms.strlen(t2)<>50 loginkey 没有任何要求 只需要输入50个即可往下执行

, D  |, |- u2 ~, h* C$ g) M6 n9 T//
6 i0 K: g& w! K- _
4 t, l; |0 x' H6 L' ?0 wsdcms.go "login.asp?act=out"
. l0 R- [& C5 \: O" p+ k, i3 V
: ^- q) e4 s/ w2 ?1 b/ Bexit sub

else
0 v3 v. D. f- x- z5 j! a0 Y
dim data
+ r( i0 U5 B" z7 h: {6 z$ |) {) z
data=sdcms.db.dbload(1,"adminid,adminname,adminpass,islock,groupid,g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&t0&"","") //根据管理员ID查询 ID可控
4 x: b* p' m1 q' P. ]- m- ?3 |2 p
if ubound(data)<0 then
( b( Q% \2 `4 `
' \) Z! _1 Y" X! n1 ^1 r7 p' T3 k# csdcms.go "login.asp?act=out"
$ c3 j! f' G% w$ s# u/ A
exit sub

2 h; j& F1 s( R: N+ I( eelse

4 R: I* d! @% C% s) [- tif instr(data(1,0)&data(2,0),sdcms.decrypt(t1,t2))<0 or data(3,0)=0 then
- \6 O7 {% V4 `4 k( I
3 I2 ]' P( r* \; L$ x1 @sdcms.go "login.asp?act=out"

; j' y, h. C9 i0 l3 texit sub

else
: ]9 J6 W0 y% s9 D; U, q
adminid=data(0,0)

adminname=data(1,0)

admin_page_lever=data(5,0)

7 {9 K1 Y! x/ L7 badmin_cate_array=data(6,0)
4 C" {+ w1 D- q6 Q% Y( k. z$ M; O
1 x, q. M1 g* }  Hadmin_cate_lever=data(7,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0

7 \3 r2 L: I5 Z2 L2 q/ F" Bif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0

if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0

if clng(admingroupid)<>0 then
& z% G" H$ b5 W8 k: i
admin_lever_where=" and menuid in("&admin_page_lever&")"
! O* Q) r. V: z$ j! G* ^, ^* t
end if

sdcms.setsession "adminid",adminid

sdcms.setsession "adminname",adminname

+ a3 i2 H7 a* b. Ssdcms.setsession "admingroupid",data(4,0)

, _6 }9 _" ^$ L: ?; mend if
0 y4 a6 \2 a$ C# J: I$ a
/ c; J3 P9 l% Y8 V* P$ \end if
! |6 n9 O7 `! ~: Y+ J! @
end if

else
  a' s; q' l) i! n- v8 L; ~% G# B
data=sdcms.db.dbload(1,"g.pagelever,g.catearray,g.catelever","sd_admin u left join sd_admin_group g on u.groupid=g.id","adminid="&adminid&"","")

if ubound(data)<0 then
! ~0 U8 c8 R; u: U8 h% `
sdcms.go "login.asp?act=out"

exit sub
! Y$ X; `8 [0 W. m0 p7 k$ T
; U% @$ `, A) {. X( B/ I# h! e% Welse
+ X) J7 f* Z1 P/ a! |& \
/ V4 ^2 v; x4 j2 badmin_page_lever=data(0,0)
4 |) G) s# y: [3 ^  Q+ D
admin_cate_array=data(1,0)
4 o: W0 [7 b0 A/ [( F. M
3 d# P8 }5 f* g* Y" radmin_cate_lever=data(2,0)

if sdcms.strlen(admin_page_lever)=0 then admin_page_lever=0
! I7 X( J/ B( d/ G9 _2 m
' d7 h0 [2 A7 S. ^5 v7 qif sdcms.strlen(admin_cate_array)=0 then admin_cate_array=0
9 j, l# }2 f% s0 _2 E
if sdcms.strlen(admin_cate_lever)=0 then admin_cate_lever=0
8 Z% N; N& ^: p; X
4 b* s' H* u) y$ P8 S$ w" U- nif clng(admingroupid)<>0 then

  W8 A8 B8 o7 ]. A0 m0 }, S1 ]" W# Badmin_lever_where=" and menuid in("&admin_page_lever&")"

end if

5 g) Z3 M% d/ A% s. ]end if
7 ]7 T% @& ]6 Q4 k( G
end if

end sub
漏洞证明：
( q1 i4 q2 i: [看看操作COOKIE的函数
% Z7 E5 e9 `4 Q5 X/ Z  [
  J" J: F0 R( ?  [6 Wpublic function loadcookie(t0)
# {) d) f0 ~. C! c
4 b: ~5 e; ~- `. {5 ~; B4 B5 rloadcookie=request.cookies(prefix&t0)
1 ]* p- S) u* F. U6 K& k. |
end function
8 r6 g& d! E7 X" d) h
# s& K2 C# ?# A1 b+ [7 zpublic sub setcookie(byval t0,byval t1)
/ p/ Z" @/ q; F* Y2 Y5 l& e" X
response.cookies(prefix&t0)=t1
, m4 c% U/ |; Q5 y" z2 \
end sub
& I! _, h( q. k8 u4 L
prefix

4 o$ d! h: @8 @0 H5 |4 {'变量前缀，如一个空间下多次使用本程序的话，请每个程序配置不同的值
3 }* t5 t1 G& |% B0 ]1 ?: A
dim prefix

prefix="1Jb8Ob"

5 c$ R* ^" Y" _9 {& a& t7 G0 e: ?'这个值访问一下admin/login.asp?act=out 便可得到 在COOKIE里

, t: F  W% W; I* B: _, osub out
* a# e! d8 _. M
sdcms.setsession "adminid",""

sdcms.setsession "adminname",""

0 P: z9 [% [. k" D) Lsdcms.setsession "admingroupid",""
, Z) f# l7 P/ E- j
sdcms.setcookie "adminid",""
7 P' W( ^5 \+ Z/ n% f
sdcms.setcookie "loginkey",""
4 c7 p9 q) ]* V* y; o
sdcms.setcookie "islogin",""
% n( v; w; F- s9 |
sdcms.go "login.asp"

  m6 S+ j* \  wend sub
7 t& g1 S/ y. A, \1 k: ?% z

利用方法：设置cookie prefixloginkey 50个字符 prefixislogin 随意 循环下prefixadminid 即可 默认1 然后访问后台，就可以了！
* ?7 J# e1 ]  j: d- F* w/ v修复方案：
& u9 n0 C2 [5 @  g( g7 N5 s* w修改函数！