Desdev DedeCMS SQL Injection Vulnerability (CNVD-2018-01088)

Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...

dedecms最新版本后台getshell

官方下载最新安装包http://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7-UTF8-SP2.tar.gz 环境：Linux+phpstudy 上传图片抓包 POST /dedecms/include/dialog/selectimagespost.php?CKEditor=body&CKEditorFuncNum=2&langCode=zh-cn HTTP/1.1 Host: Content-Length: 42080 Cache-Control: max-age=0 Origin: http://...

DEDECMS member center code submit defects can getshell

Preface : dedecms this year to update a lot of patches,the present article selected 20170315 patch for learning and research. Body: From the official website to download DEDECMS 20170315 patch using DIFF comparison tools for comparison: See the Red part, the servermsg1 variables appearing in dede...

csrf vulnerability in dedecms v5.7 latest version

Dedecms is an open source PHP open source website management system. A csrf vulnerability exists in the latest version of dedecms v5.7. Allows attackers to exploit the vulnerability to forge form links and trick administrators to click and add backend accounts...

DedeCMS stored xss vulnerability

Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function shopsdelivery. in php des parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the users cookie. Test environment: DedeCMS-V5...

Dedecms presence of a stored cross site scripting vulnerability

Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function carbuyaction. php in the address, des, email, postname parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the administrator cooki...

Stored Cross-Site Scripting Vulnerability in Dedecms

Dedecms is an open source PHP open source website management system. A stored XSS vulnerability exists in the address, des parameters of the Dedecms membership function carbuyaction.php, which can be exploited by attackers to obtain an administrator cookie...

Dedecms CSRF Vulnerability

Dedecms is an open source PHP open source website management system. Dedecms has a CSRF vulnerability that allows an attacker to exploit the vulnerability to perform unauthorized operations as an administrator and delete the account of any user...

DedeCMS /member/reg_new.php SQL注入漏洞

No description provided by source...

DedeCMS /member/buy_action.php SQL注入漏洞

No description provided by source...

dedecms v5.7缓存文件data/cache/typename.inc导致任意代码执行（有条件）

No description provided by source...

dedecms referer xss跨站

简要描述： dedecms 全版本！xss跨站一枚! referer构造触发！ 详细说明： 文件：/plus/vote.php code 区域 $ENVGOBACKURL = empty$SERVER'HTTPREFERER' ? '':$SERVER'HTTPREFERER'; ............................................ //判断是否允许被查看 $admin = new userLogin; if$dopost == 'view' if$row'view' == 1 && empty$admin-userName...

DedeCMS 5.7 plus/guestbook.php 注入漏洞

No description provided by source...

Dedecms远程写文件漏洞

来源链接：http://seclists.org/fulldisclosure/2015/Jun/47 http://blog.nsfocus.net/dedecms-write-file-vuln/ 0x00 漏洞概述2015年6月17日seclists网站上公布了Dedecms的一个远程getshell漏洞细节，造成这个漏洞的原因也有些让人玩味。官方已在2015年6月18日发布了修复版本，下载链接：http://www.dedecms.com/products/dedecms/downloads/本篇文章将分析这个漏洞的成因，并给出触发利用方法。0x01...

DedeCMS V5.7 SP1 /member/mtypes.php SQL注入漏洞

No description provided by source...

DedeCMS 5.7 /plus/flink_add.php SQL注入漏洞

common.inc.php这里开始过滤得很完整，往下看//转换上传的文件相关的变量及安全处理、并引用前台通用的上传函数PHPphp if$FILES requireonceDEDEINC.'/uploadsafe.inc.php'; uploadsafe.inc.php//29行 $$key = $FILES$key'tmpname' = strreplace"\\", "\", $FILES$key'tmpname'; 能绕过 GPCplus\flink.php虽然都经过...

DedeCMS < 5.7-sp1 - Remote File Inclusion Vulnerability

Exploit for php platform in category web applications ========================== Exploit Title: Dedecms variable coverage leads to getshell Date: 26-06-2015 Vendor Homepage: http://www.dedecms.com/ Version: dedecms 5.7-sp1 and all old version CVE : CVE-2015-4553 ===========================...

DeDeCMS 5.7-sp1 - Remote File Inclusion

DeDeCMS 5.7-sp1 - Remote File Inclusion ========================== Exploit Title: Dedecms variable coverage leads to getshell Date: 26-06-2015 Vendor Homepage: http://www.dedecms.com/ Version: dedecms 5.7-sp1 and all old version CVE : CVE-2015-4553 =========================== CVE-2015-4553Dedecms...

DeDeCMS < 5.7-sp1 - Remote File Inclusion

========================== Exploit Title: Dedecms variable coverage leads to getshell Date: 26-06-2015 Vendor Homepage: http://www.dedecms.com/ Version: dedecms 5.7-sp1 and all old version CVE : CVE-2015-4553 =========================== CVE-2015-4553Dedecms variable coverage leads to getshell...

DedeCMS Arbitrary Code Execution Vulnerability

DedeCms is a free PHP web content management system. DeDeCMS 5.7-sp1 and earlier versions suffer from an arbitrary code execution vulnerability in the implementation, which can be exploited by an attacker to execute arbitrary code in the application context...