SDCMS 2.0 beta2 backend bypass direct access, an uncommon design error case

Go directly to the SDCMS background bypass: test version 2.0 beta2 is not tested in other versions
 

Islogin // Method for Determining logon sub islogin () if sdcms. strlen (adminid) = 0 or sdcms. strlen (adminname) = 0 then dim t0, t1, t2 t0 = sdcms. getint (sdcms. loadcookie ("adminid"), 0) loadcookie t1 = sdcms. loadcookie ("islogin") t2 = sdcms. loadcookie ("loginkey") if sdcms. strlen (t0) = 0 or sdcms. strlen (t1) = 0 or sdcms. strlen (t2) <> 50 then // it is very difficult to judge sdcms. strlen (t2) <> 50 loginkey does not have any requirement. You only need to enter 50 to execute the code. // sdcms. go "login. asp? Act = out "exit subelsedim datadata = sdcms. db. dbload (1, "adminid, adminname, adminpass, islock, groupid, g. pagelever, g. catearray, g. catelever "," sd_admin u left join sd_admin_group g on u. groupid = g. id "," adminid = "& t0 &", "") // you can use the administrator ID to query if ubound (data) <0 thensdcms. go "login. asp? Act = out "exit subelseif instr (data (1, 0) & data (2, 0), sdcms. decrypt (t1, t2) <0 or data (3,0) = 0 thensdcms. go "login. asp? Act = out "exit subelseadminid = data () adminname = data () admin_page_lever = data () admin_cate_array = data () admin_cate_lever = data () if sdcms. strlen (admin_page_lever) = 0 then admin_page_lever = 0if sdcms. strlen (admin_cate_array) = 0 then admin_cate_array = 0if sdcms. strlen (admin_cate_lever) = 0 then admin_cate_lever = 0if clng (admingroupid) <> 0 thenadmin_lever_where = "and menuid in (" & admin_page_lever & ")" end I Fsdcms. setsession "adminid", adminidsdcms. setsession "adminname", adminnamesdcms. setsession "admingroupid", data (4,0) end ifend ifelsedata = sdcms. db. dbload (1, "g. pagelever, g. catearray, g. catelever "," sd_admin u left join sd_admin_group g on u. groupid = g. id "," adminid = "& adminid &" "," ") if ubound (data) <0 thensdcms. go "login. asp? Act = out "exit subelseadmin_page_lever = data (0, 0) admin_cate_array = data (1, 0) admin_cate_lever = data (2, 0) if sdcms. strlen (admin_page_lever) = 0 then admin_page_lever = 0if sdcms. strlen (admin_cate_array) = 0 then admin_cate_array = 0if sdcms. strlen (admin_cate_lever) = 0 then admin_cate_lever = 0if clng (admingroupid) <> 0 thenadmin_lever_where = "and menuid in (" & admin_page_lever & ")" end ifend sub

 

Look at the COOKIE operation functions

Public function loadcookie (t0) loadcookie = request. cookies (prefix & t0) end functionpublic sub setcookie (byval t0, byval t1) response. cookie (prefix & t0) = t1end subprefix 'variable prefix. If you use this program multiple times in a space, configure dim prefixprefix = "1Jb8Ob" for each program to Access admin/login. asp? Act = out to get sub outsdcms in the COOKIE. setsession "adminid", "" sdcms. setsession "adminname", "" sdcms. setsession "admingroupid", "" sdcms. setcookie "adminid", "" sdcms. setcookie "loginkey", "" sdcms. setcookie "islogin", "" sdcms. go "login. asp "end sub

 

  Usage:

Set the cookie prefixloginkey to 50 characters. prefixislogin can be cyclically prefixadminid. The default value is 1 and then you can access the background! Solution:

Modify the function!