Dedecms v5.7 File Inclusion causes Arbitrary Code Execution

Dedecms v5.7 File Inclusion causes Arbitrary Code Execution

The security box Team (www.secbox.cn) today discovered a code execution vulnerability in zhimeng decms, which can execute arbitrary code and cause getshell,

 

Affected Versions:

• ≤V5.7sp1 official version)

Overview:

• When auditing dream dedecms, the security box team found that the filtering is not strict and arbitrary code can be executed, resulting in getshell

Vulnerability details:

Need to log on to the background

Set a random template in the background

Enter article_template_rand.php

See here

 

// Perform random template processing on old documents else if ($ dopost = 'makeold') {set_time_limit (3600); if (! File_exists ($ m_file) {AjaxHead (); echo "the configuration file does not exist! "; Exit () ;}require_once ($ m_file);/* omitted */AjaxHead (); echo" all random operations are successful! "; Exit ();}

You can see that require_once is used to determine whether a file exists.

See what $ m_file is.

 

$m_file = DEDEDATA.'/template.rand.php';

Then you can see the save Method

 

If ($ dopost = 'save') {$ fp = fopen ($ m_file, 'w'); flock ($ fp, 3); fwrite ($ fp, $ templates); fclose ($ fp); $ okmsg = 'configuration information is saved successfully :('. myDate ('H: I: s', time ()). ')';}

Write $ m_file. In article_template_rand.php, You can edit the template. rand. php file.

So let's see where the makeold method is going.

 

<A href = '# 'onclick = 'dorand (\ "makeold \")'> [<u> set all </u>] </a>

We can see that there is a makeold in all the settings, followed by the js method

 

function DoRand(jobname){ChangeFullDiv('show');\$DE('loading').style.display = 'block';var myajax = new DedeAjax(\$DE('tmpct'));myajax.SendGet2('article_template_rand.php?dopost='+jobname);\$DE('loading').style.display = 'none';ChangeFullDiv('hide');}

Now I understand that, in the background article_template_rand.php, edit the file and write a piece of php code. Here I write a phpinfo

Save and click set all to see the effect.