From a596f874fafb02a1294957104e5961a208db366f Mon Sep 17 00:00:00 2001 From: Evi1CLAY Date: Sun, 23 Jul 2017 12:37:35 +0800 Subject: [PATCH] =?UTF-8?q?[ADD]=20DedeCMS=5Fv5.7=5Fshops=5Fdelivery=5F?= =?UTF-8?q?=E5=AD=98=E5=82=A8=E5=9E=8BXSS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../README.md" | 32 ++++++++++++++++++ .../add_delivery.png" | Bin 0 -> 16589 bytes .../local/record.txt" | 13 +++++++ .../show_delivery.png" | Bin 0 -> 21991 bytes README.md | 12 ++++--- 5 files changed, 53 insertions(+), 4 deletions(-) create mode 100644 "DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/README.md" create mode 100644 "DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/add_delivery.png" create mode 100644 "DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/local/record.txt" create mode 100644 "DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/show_delivery.png" diff --git "a/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/README.md" "b/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/README.md" new file mode 100644 index 0000000..0a0337f --- /dev/null +++ "b/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/README.md" @@ -0,0 +1,32 @@ +# DedeCMS_v5.7_shops_delivery_存储型XSS + +## Affected Version + +DedeCMS-V5.7-UTF8-SP2 ( 发布日期 2017-03-15 ) + +下载地址: 链接: https://pan.baidu.com/s/1bprjPx1 密码: mwdq + + +## PoC + +该漏洞比较鸡肋,需要登录 管理员后台通过 添加配送方式 功能 才能触发, 添加后在前后台都会触发 存储型 XSS。 + +之所以会触发是因为在系统对 管理员输入的 配送方式-描述字段(des)在入库前只进行了 addslashes 转义特殊字符处理,其实这没毛病。 + +重要的是取出数据库的数据输出到页面前没进行 HTML 实体编码处理直接输出导致最终的 XSS。 + +测试: + +1. 后台添加 配送方式 + +![](add_delivery.png) + +2. 添加成功后直接展示配送方式列表,触发 XSS + +![](show_delivery.png) + +此外,这个 XSS 在前台用户购买东西选择配送方式的时候也会触发。 + +## References + +1. https://www.seebug.org/vuldb/ssvid-92863 diff --git "a/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/add_delivery.png" "b/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/add_delivery.png" new file mode 100644 index 0000000000000000000000000000000000000000..0ad1b46310cb38faa7132a2313ed3e86e6430f39 GIT binary patch literal 16589 zcmbWf1yoyI*De}LfwzU)+u}vqLb2kM;8bv@xI=Mwmry9Qh2jmtDXt;71TV!Bq__lW zfdIjRd&mjj`+eu!^PfA$fA3+8jGevqT65W+bFTS3GknodlfQGD?lu4bxTB~b^9}$Y zrUd|qZvRC}C<&2DSq1=@0g5uOwf!=-=YzjJnhO4nGrPx2{FnXx9K5j$)Ucz2X(*uqQrz25Z9{1zQa?6gE5 zO{7e}=6iYO;~Dl_>9o%UEh-MC9^*#lwNKK?*;%+(A!q$;9-G`iY=UC=%VuGlSpWn{x!|zi&Po`)#u#RcG>s^p%y&xmp_sHIHdxVDhCy8~UHF?sN5t;QxFYJ-Ub6 z=Q?nSH^W^rxO~_AQZ`e5m`xX-^-wy2zM|dKW;k|=?#A^zx6L;^kZ7-Jaujen(?lOl$^AA=w!L%DVLn+*1Q-nii#mW`Lfsf#$VsZrTmTulO@x z6OZ67@6qbhp;D{gOqtAgHT`RhTY05-HgS_I-w55GJ3#IH6}85Wfs*7^O} zPRtZjy=ub_Y8qI~%QFQFZ6I$Fsy~N|q5e8brzU=DYo$20_7LCJoqgH=SowsP1^N5}c z*o5vowjVoQQeE$a#c zzVob8Ccc>$@30eYl;)Se$)w%FKks`XB2~(~4#A>PYxE;c+48`-6qUm(x zeVmgR$kfKg=<{}deqg9}o=PyZC8l9gdmPVz@=@GaOyN&)Iq&`XtlANEmp1Uz%tH_J zUg0lN6jbU!;bB_$DUw%@mY+F+j<3i(4pf0XA==xZ^Bvz7z;aCkVj#6YW#Z9(}12f#TeAv^~lv|!I(Y4kUTPQTqwGIXr?PTxKJvht1#$ zD|G(UaZ+p-2yx0=$2EP|=*h9)Ks!ydwX~2n=xL|g**Evbjfks#y}KQFAO29!tiSCp zVEJ3sG479i`?uyDqg&R-h5FNdkyb|b84X|dXy3V}6;KCTH%;>H;d?IBwHM(~jm z=En)ZFtDS}hv|CDN1Ss_w_{2Hbudl}l=~~S7a<)N)4!OzOorBUJ|G4XfEl+9!Vh2~ z+(kVsrtgNtb~rP!KR@u;`YT&6zX#rWTi}tt^;t8u{Htz`)5$?m0H%|$ph~;hu1LxfP!QU{|5vhBz)Mg?u^^KY`{xPG^@z`-Z zPRODC*GcfpZK;`;dOCa)$0FRmB4=~#o$klp;=!M4GGZe3ryCqA^qPDpyNs}GnMb?z zppZ=5tCA|ssHe@v0(X_Qz=Ig^jNtc{Z4^EX20D*^ijj}ENyCfHjif_V_;%d8&rByp zIy6wl$Xfu2ONJY(Q>}w#;AzAyz;fE&>Zb&9YHNbtCkU1SmgQls&l~1u*=u0UYK1D9 zoT+fJnP%7QprbO!mF%k?2pZUSs6ICZx$1W~(`&~a{W`Q6Na1O}{CV|}V*;l*AO7I5 z4i?P47?pEzxhBo~_U-X^>(PE4c5EfXL}rxB#Re(H|0qn9j0twtSGAKHWCgj`oJG^4sAu zo$W}srH-->T$4?gQYCu%^fFLWbxf4Fbs>T!J1v9WhchCA64HIoiK2v=C%Ji5`~%7y zG*T})BF)|vAj_X`}S!E?BFoM82_9@fAOe>h_pgO4AAHUFS`({iV zsZA6c1FyQ^GCNc1-!=E;$aXk79h1h5#k2NIurWXftB)G-O{#Zoe37%4>v!#)7dWrh z>%$FZpmL>D5#E6V2RAb|?7*vYHcoj^!MT` zBpq6g+lq}Z%etCg+1h&nlbU=7eJ3%sTJOp{P)a7R8GVFJMxu~&k-;7WNsN^hepTI^ z^I4rg>W{)<1?QJ*B{Da04U{m=Z@c&Bd5lc;yCWxh<9rkq_8P)oGo5iwx&RqPtA zaZP{tS9Ddn&d6R~K1w@BJa=}gwL-p3_U?sAuY;^wk2%K zo+&wd>^_@%R=ER zSmf7QUng*#5k=g(WSh>c&iPECv3a$LSVM8>Px7Z3>oV0%wK`&h^i+zIU*3xW%aa({ zKKD@-%y7@h7Vf+=^-VvElVSL4t^e`btKbD_RdHF*nzemfwDL}2m;VrvX_$#_3vo3_ zO_S`s_rBe5X5&2ZLB+E(9#;1kA?77QE?iy=VoT6aPl0WS-hmc0F{Vsiob9{w5OQv! zh|lb28o{GjxOQiHLVVxv2SWXT?4>*$ww`*UC{Ie0c5>~IZtG8_L3L~JZ;g}@CLa00 z{)v>3f|#NHla5;kXlP^7Rgh+SMSJB^wZpQ5==QfW;WbK~C+td7aROnTkiY`*DHCov z;1kdIzXwC4Uq9*C@;FQv)hboA!z9QVvF@1vBlwIvRcdT zSYiQnos7)=ptn0o$H#AeW65GS#Aow3zo}Pn4y=J5WTF`uC!1Mk(cz7kG^iEF z1Cog4=LN*^_Z4TG@;;;H>8q=ORSlhjg0>y^|9oOXmNbxBPmbHW06EYbU@ninCE2E+ zvqXCR)A47{^sdd^LV^ydgeV5OJdx+1;}{u`sQuW%5WiP%y%{Kb%;=irJRh+UFqZ5* zT3=^kia|ZyN0^E(`0(8~XLqzdaiRQfb(@>nxoCW@0I6SXV!BTpQMXy3I*ZN^m>Vy_ zRm;~I+u6hB;U>vKScn>1pMGLk=LSq1wVxc*lG93?aWS&vRD{X41Iqij_ZzfakI z$>On;;akw;CWWZG*@$h88rj{InwiWSoN^nY6$Ek;)A6dFIJ9PP9qRaS_I4*Zd#T&( z+|okV6)(}@9V*~y+a@1$4@A}ya-4T2>T)T4k($!>{`2txLxI_IT)SOeYEn_U#zU-I zkp=L%$5NM(BHm=85G)z?o8z9gY4@^Y zN`NJY+`9}6tGzsD7T|!kY#y9j2hTc_9K?#M zT@8JzJ3sBdZ@jnZ?=xVkI_^M1{hqrWU*5tt~6$OyhQ8e1p`Gx zon=|yv8gRI-6K0t%d~HH-bMM#g~Hqb{1uSPB#d782=P&@&@f8`Jzn&5rlKO7dn5Ug z%fvnvX4cp6?f|W@S2oA0PDKk3QOKrz#*PG|B#pb?ToC0nN47$J(c2^7N4;6^5cKbk z$7?s!oB2`Cr*8c5k?hMfh61%$o4Xhi4!*!gzX@b^kW(5vr%+A*G)pt}=NzbWSbpZ= z(%beUW@6z@9aYM^Lfq30PSBGM_JtED+95aqvdEco;dk6Z0UW5(tqU6f=QrBZg+)~7 zyLb6|k$+YEqo{8h{kb`=H%*JYL+6!wpogg_Fi7uDiXHq93eQvG?W6m|)Y1Cg#sVw8 zmFipB-gnlhKN_@?Il(UM)5@tZN)N z_;SCKZ0#9n;pyhU74KEIT+=};3jHJELB9xo{GR0{gn%6EQ-k*2o*gRHuY04F`~ucO z_+NO^Z{@_Cv$`I=4curD@QSA5_Sh)vCi~mFtKqi7xCEs=+>FtrT7I^UX>fhh4kD?{ z2);-kUzfM;&pQ6$>Tu|-AYb(G_aP&-J?gn>X1i8BwafZv^*V>gi<~HN@^G;RSMaj) z=6s;In0U+Ll-=wocPk3gx3{3R>b0~`i8&5r;4#L$qa3xst!~ae43P2mcXhknROXgf z8<==lbWm|g;cX9$7q`C{X3+Z(ez-+0!6bR&Rbrks$EEdlG>>r}K392zb9j<0O@4kC z%5CKBXxGH+`%as3?oVzytd$L@Sb=XgeO^khm}6EQIHAQ$4ff#y?I?P!yD_&n6)A&P z`pcN_`g6GyPnSwS4z@yE=Sj`BJ;D`nA={T?4x4C5rqSN7hBz~hD6LzXL`hm;l1(G|KhVwierR1uW@4%?YGwcU5gSga+ zs;^yR+9-R-Rq%F{|J#~l+>6vUfvIU%^scy3pV^bLjKfm_@H)zD*O%l|1C$_-K z&>R2dk&6efSdZVl*b%mPgDMsOoKf`mHj)z%oX-jxR_b?v%Xh5o8>EisL98gwB_b-g(kjXG2bR7i=`NRFFHgtq z4Qkz9TixLN<+t=DW(aZ>w=($QNl7-p)~Ycm{PGXeRgP7S-ior>RZ*3o=W)2_{-!Tz zNX&FzyCTF+9Y>RW{zM8--8wN=;KkXYF;={Y&^XX8RIK-6`nI4_V^zOOiUFDdofCG# zTNCYv`X(<$Y`t*dVKZLSq={*zt={q@pe8}}5drm+^m zyV0|64B?>65J9gjp5hjn3tPo8L@Tm_dzM>6t_!n^DVZzfCjuH~!G06FkMO zvZdPvU6u0!i4X;9+GRS{gRV(l`}CD7WzPtBf07TGHd zH8C~W^W3yPUp5GLT*%{X?%bA#n(gkxQZ6uXy`#B3wFSNG;iIFI{rRPg_)nKE(hl>w zWlBY66$=4qWKD1us=XoJ45qRTz1t@CB?Gctd~xCpay<^7TqWObAz* z$!??0xq<^*yQdm;Q98=M<>^=h1c%zLKoZ0Rw~ZL+vFQ&$5|2)4hopsHR!km)e_59D z`>MSKr1bB%Tbn*IgOaO}u6s{G+h%4c(8$zxx$wNbxz@C>h;?hpk zJs>5GaU7Wr&_UWw#D9oH6IGw+ENyd4Z~mCC-pWdVwrP9PEFsDDu7cxOuKukOs+e9T z{Mx=e?@n?y1%=Z5c**|nxA%I6`bu&H_nS~IQ51ZSC?zh3u$QqHZv#R26Hqot1q$ys zBDu4n*T&`AnZk@{wD5edaDJ)=V12%|m)F9Ur}K7wu>YlXz&EU)pRr>_+1kdetC4xN z;KC_%uIjsH>}6bg!tne*kTW>twvezy+v}^X;Va{f!ts9Ti$M_8rd~U*aSO{^*LLoE zS8|uVL8Z(~(Po$Lw=itbxxt_$bqwq|v4Y(XM(GxwAj{5a+=L_S>sFjLP2gn_>gCTf zZU%r3#D8MGWqY$5x}mq&}<&2h-gmyWue_SeXGaqB=jR-TL& z!Iu5CZ_$eZVsIpwf3zbj&^*xb`$u>5=zQS2A<${UB^GIjo}HQc2EKbeuqqCp_?)0~ zOwlNQ8ECzp>1%xjZRj)cUEmSiSjNTn6d)lhy+x$x@eY&+a`0efr#sq;(!mzGqc zMiOx1mumMt@`6?cr+UwGBnfQ+%SN)VuUQ?yO;yS_6xUxk(v-du5w6UtTFn7hRg?bL zg?t~Z2)k=HaQ!`=j`8FgwrAG4NnnKlfOoR-|EmAr+-j92*nvQxmxoxoEsSy%*rVmuE%Y2DAn8V|*dNpBvcMCyrW z+w%%K1TVj+84W5qTN^ZDw;j$ZWoIC?Hdm>$DmJ)8ROhyzNMq;xIl$IBi24E5^g^RG z|I|OD_zYxtsLMDb_Yj8aid+|x37tZ3m_Iy{TETlJO*xaxaqw0SPS;TGTe&3kT{QKXQ zrL0}4T=<>71nlbKCfEkNgS~PI9x=Z1(1AK*b!rbaK7-9c&dZa_k}cEJ zMvS<}Ys>Up6OT6W!6S#AEhJOieP&s0#-J>7(=g;0r3>7NIwja!KY-9lsOn(&SI~j0 z&B`K^REr=!q&v!Wg$sk|HYc+AcU@Lz(Cj3?%fBQm4mK-eh{8AM3MvXOvMG-YU?1b28==jZ z3Jdvlel6$IsuaDe7g|~&Ck#VDdC*88?5YbyqnP1hk_Pa8cF64Y`@`21)09j&+cAhs zx#OkIR?2?~;r^Vj3t{{JGAfJ_EoQH6lz~PYt{rWH%#N{mNg#Loi?GXT&E>pN3i_f| zJ$u|5zD2F=>WFv}LwIXL*)2KyG)~M~uFjcOq%SD#w9?ciy<;v;&elLBB(xJvdngu8 zRWNTR0wx`Oz6mpO69ZSYyO>=rxi<428K^R42)l$NekDiJ6UKI5p0Jc>ln&jn@vGlt zc;6A*;53g>XoLp@My4)xWO_%BH@MM$R%su@d(BxD%Mcbb1b-r3KlHGC_k07?jTJ$c(yTzB_BsExOnbKLJu`n??5})nHA25cF#n@+8xEP*8Vh(x&i!wr z@J|Kpk;H$D!+$jSzdY7~vRay(e>YUT7DLlT(A?VkdR;Di=9lyH^IK(vLXN!VM}$kL z_JjZ37U*neQJ6pV+bAh=$RznnJS>e5g4PhMVal6$BAL@wV7tNQ3v-IVwM<{abAmT` z97e(XV<1(~@%k>*oiOmve8K03hPH(9nHxXp13Vp{nwk>3p5O9qb;ylScb267k0G&i zw&_xsT6Z(_XT#oNFQiF@l$YhG~uVQ~}YG!_pJx{&&NC$x`5ry`DW+t|zVsl`o)hZCdoG4`X==R561doT` zlx#JJpZlQ%!t61LwL>hT$sf77UO11PPw)S%y3-*e>&r3zF(kL%8@3Cxn_Y#~D$6yU ziy0ClUBR(!hojiJ-v!M%HK(mLRv5bpNb_qkRwt1juDW^PP2u-V7fqNzD@W*GA-qQ? zXs^uMYL-TFDI%DQ&0@WMXPAin?BvY7SSO4eRDRSSU@q~jucMfLk!?fDU$(vpDLGv) zQ-31nzaFf;qJ4((c3QtLDQD1p@x7L_=Y80Jasfo~ldz)&*Tn^{=Bd)(tNfUGU487r z_EWZttuFp6FPGgLlM#c?qbYH!8(Y7!g*At5U4Jjv znk}<-qf0THv1I7eIMIU!s)nHHNJ|NaL|N{qfyd>ZrfT|4eUEua+wawfwkDRXx*H1o zfHTa%>CWuaZ;+1#eDt=yP5wN0p9#Fk9zd8?3&zz=0-&OOleW0TA*0xFau0~EwqBtST!m!uQ`NlV z-#TiFk;EM`uj4;x0yWjggJD}>Nu%_G%}N(_^__*!b=85mtGV6nYP*x<^&OQ=*yomS z-fsxxO*$gIUcq;gZ%Fv@a?k9%!O2y+R%>AX$+wf4M?pQ56RezlK7!tKuLBLa$t(^E zMk0{4U(FpIwaqC9di5RMNkT_n5xNvKWZUrIRk9Dk}@f8ww?x;dK=teG?)Y0fmyV@)S=2B+BA0u5!33ajq)o}$U<6=&e=-A(Op z_`NMDd~^h2lxxV7xIq>s&{A1m2+M~z<2V}tAFbOmP)=1e_=mS8Mh3c5q~EaC*q3#u znmxVQ_5HSse}606aw9NdgLI-*HZ6@x(X~eFY~R*JoW1#ggZrC}0o!0I)FpJ3ko!_^ zP|s-g)B|tWga@~J%o(W3c{dm?ZZ0%yDm>>h8c&x^{*zL$~1|KCY$Se=sa>qx94A&5v{Ii91O``#&-hzwG=%N3f|&OFgaxV+tsF+IM}4=M4Mjl=h!nmrK$& zPScg0!7?0#$4k%p0B^J}POdXMoDT#}Gs;%q!D7|L6$upp%Q6!# zmoCoEP~Fj24)EsY89hR~cXGbh6912mmwHb_@2g85X+vu?DF5Rx0MGfZ9RslaY|zm5 zi4L~qK<(O%0G^Bd|MVApE`-2u`GRFkZjd@zEyLYGf7JS?DzN|ZoC|u0v*$EvudGd4 zDVjShOTg#*e-@k*=6R9X2=h2d_mVD`8TI%gXp$&Y)^tzzS+IHelfG9QJ(eV7B=$NQ zqljo#;q*IDr;DwD@RpC);(%;1ef0PfNiP`r&1Y`d z9Z{PRTAg;$+%_x+HPT=BQFzke>&EoCM*7g(DL%Gs^p9eL@^nifrc86vUVGiSHzohV zV)W1%^`tS#y!=_;E7=}T5;7YLaFPhhOK9fCt%pYF)(mff!H3Cem0M2Mv~?g9Cs?sw zweqpb*==Q%u(Rlo(fXJ;ggWb)05sj~fy!n|lGS|JK{t1Fqd)s-(`&{gXmvqJ?F5?x z{w2Co$jr^eX)~e6eZF>p&!U%XtWpI1pk?|#5Ld`;B+H0m&dd=d?U4$j(6*A$bK@MD z8c8d2`ziilx==lBNM@?($us&JBo9s;>ZN(gb74jHNj;Q%N*{GJIOnlP`}`y)ntGYe z2L(@D3izPp_Y`3wpU@@7?g*(<;LiE;X7~aJ{V@#ULTRC}N9hv`Qmo$2yYoJc?Oy_X4m}UrRBEPgM=R1&?MFC5%xEk3;aR@u>C zKPTdUi%ZKWb=^8a_t!%r%9a}oSB^FnqK#+|zO z&2+c5&872ur|w8Y@V#7w#Eb9MXdQgHYhW;gDvG6iE4OXfVv~|Bc-YYW2L+Fmh4H_( z@jXe=ERn(@SDH>dR^#-34<)?AhR)N?6%zRct z?+WWot8hRYy9H4cEaQlOJJ13=S!vEORDBr~iDn&wM+Vy-wp)OAL>3PkmsaL=bGX-j zgfqJJ^y|$oY5&NZeC7Zz{yv_M&2Q`scB8FF%Q7s6Z#tsxC6Rs>E_5!1gtwWcBL-?g zB(fxMi%l)HbHopugruY+#KY$||Gni1@6waT+7}Lp;A=N2nZtGiMObCpJDT7>EZ}9U z@$=}dnVKR0FS>%PCM{7U92z&2{t1b}|i7Nf}&FEGP{O=4QSp99Q>0R?H zoOeuV~Z3w1~;qL{+cO83{e&XR!y|f7uFUWp~OZX z-w*z*j33(QRL|((egWm{JkT3IdtrZG6d?Oz$|%(R12eI8Iy+@XK9w+ULRL`H+w6=j z`&*L#)`xl@-^p!8?^545qZ!R?T)KvL;lluK7U;*qiKmY;7IeRS6_?n!patR!gSxHB znN`sb>!i;4w9W&>+)uJadP|j#yBfJ4Di*3cZ3iUaA{OxH0kg>rpPaLm&Vv=sO&T(R z2y4R-xAvF86)eHtf>$91yoIKDbz&z(iVv*5J6YC+X>Aj`jp5>=wt`uG501I2_0p^@ zXvf%8ZG~hr$IEouLMk65LyB+bmW0t#IE7=)`MrfHKE!hp1qBp&gK#7bu zuub2X5aQAJdCQ7xWXk>BWRbfioyOanv^3rm6~DDj#;E);nrti@nBU18I;`}!pg^`j*1f#+^xU`JUd#upb# zur1V$wqk+5T!uYvP=JEwbZ;1$zc*4#X+#P!FfF$0^olWzprXl-r zx6eW^G4JkrAy+_QZQ{nx&fR&v?0^jp|Ese#F2f%Ev55&*WeCs9Smn_${xr6x$}&V@ z@H0+Vch0+o-gP?qPWHWLQY?znYNFFUpU_X#BE&E!VkMQ>5N*Jt$JBM%EG9k~+l+eC zR}XZOH7|^&1%eg#oso`BXNPMgR_&a&3nD0f#odJb0i+^R3VY$C7;y^ClJSSz;+XX@ z86CI8jBg1lFDs@Co;Wqt2j|Tl{wU-(vF8Cwqw}+cTG=)A@{!y{9zUDJO#9Cvf-vY~ zPJ^||BMw`J(xw=Bf7z+G_T;S5AMjitj3WPii=G?7U{@Q;npam>M~G5OFoYf1D&wqdZ*jJda|g z{I-V3-i;I*?d6EuJR2K@{o`PZT8$BAIdoU+-^ii zL!^_*vqM-Q8SN05soRYhbyojgj)Q)mciCawTv!rIK#y1hF4v`0r7Zo)SkYiItriR% zu;yAgbW0+G+43FJB4CAZM3Qacc~?sEmV`!n>jLDE`2;{S);4#jn)(i?T4+@$nqAn( z(*E@Z^CxEFU)D7qIwZ7uyiMFR2ncrCbXkR{WBRab%xK=y8aF;8FevJyrpcZ7lLkOI z&#@+gQq->*zs=t7g~*srlUX{MtM?2}Yk(S;COm*C_x*kGcBQIq#@eCgy5H#`*T&6`>nmM>KuaH)fluZvekMx z+a~14F#CD5#kA87XU?HAw5m!rq0t^0nc=QHCzu(>P0 zbcw0sMv1HKwV#XJ<5Jpv(OQv<0meU+zWW6PUV&A4Vexs9c2Aw!NdVf^uSqpXb*e&i z+pJ6U%gV|R3RIa0WY=R_1(~Ap%12S1gjRKlpd+5F2z73_i|f~CZqR%Rxj}|?=-&ZKKx~auUUlllrhhYaa61a zU>-#}OXasW@J?mKs+n~1YES<_befT!fR&3YO?SvnTHEi+j*%hQ^|LxL(UZOht3i7C zl@%h#UO$jId^o{Mh{c-%d@P?b&_Fo(mkq{M7=-CB85P%Qrm$#U-4?uUf9J3 zxGdX-*Z7L>;vi1VRvovca9q$HGAFXQM{U~YV>r6y)x*HckQRKN)3LkEYn2_6!!9?I`b)uXTbe3;#2j>+=0e1NiZqOKbk z3zl!ef9$2(Kb-J-CG&8_16>meHZL?n=-4tpd7SBC=9VFP_M#=#?1rpHV)Y(wk&8)8 z7SnfGyYHK3v7X(UXQDvyKV`a-(iZsSjvqkpWd+{eq^ZtML3W~c9GdQlTAv+~KR{z4 zUo6t;iyBt&jBJDxWO{nP)Llx=UIp)R?Oqk{E$v1hgXsVWmY$Red!Sg zzeb1*>Z*S=fY7Bxq8qlq7br*2l;GHc#{rR~87tu>pS&PZoWtfyPcFin9X@Q+ur3Cd z*gbi2QB=cVD&?cn#vRy_%&8m_h3uS}>$-{iiw7 z&4ruKtG2|=9z3oNb zH5}Sc1ATTLoK5mKBsy%`EEg?H&DhKG#9$*9Rk)rY@2K{c%t;1$MLgzeI{TqvCakGbUGZ={$d(iJX z;w0ZTMOC#nYa60ic|f2(qnbCjM}mz7 zD|NORuijpUToqty%NzBw+zSnkRV?h)lC35ZY*%D~_O^43yxYm~=nDSAnpdW#XK;zj z@`nd4PG!X;h@1jV((GTOO(!VB)bfOSoj@z~WzUGR5pFK)s~YvsHA=E)RbX3WA*5ii z75GDafg_!2BKP}_`h7Nbqve~n!+nlJ7auaY&}dcSYEjU=2wkckuMA+l$Mm7G#W^Zd zskWxlcK&cMA+%1y`HbHM0^UFGQcr2fLspt$P}UJAMt`Tb^eUtxYutae7Ufko#r8k< z^*IR1-9OvTTL|V@`2E9!dZ2yEnZd#R2AJf`n32ld_6Gv{fRuHztkgVPN?WFJ+lZErUtP+ntdR0<{pgl42I z;ANmJkJ*`wRNJnnD83)H4=nQS&qMllD=C|dFih8S`1msTjjR3)q%#|m&QZeo&24gJ zCxKyFSzxVBh|w713EKW5q@=>w<@;MuaoY4nkKEajxG*BaprL<@7T8zIQIpRjSTH$r zgOBuABGELck~K{0nmXOVX$zakL;PZS+8Gf+ucx0R=`67Y6JLcv{C2<=$L-{zY~Amk_71Ae4x*2%Qx}U zJU(Z&Yy$U0F*#Ex8(pr~WNnegJLoYn7G;=hFRiic)Wv^%-|G8cWHf+R(9~FrMdv5y zv?@QB-C;}jgJiFBC5*M5I1_59TR24Q9DZ{OSsQz9tJS9BA6=Gl`HU8>ob&N~>5O-b z59H^jKaDJ6N(m$5KoRwTx@qqMXz)LVp4DT**GM+ca$s-8#KOZ3J&`lanf#II$sFlb)!37)D*Z zrH8x7&zmT51G<72ayuFJrzfdIi<8GtFSel!L*JfsaU<_K+TSbtNm^8;O0C0aLAfg8 zL`@X_LD>zby1aZ7s7cM*#gfTbM*vMF?(zXb4HZ3Jnt_-k%x0SBg!_|s$`4)4-U-!W z!L3hG4G2Tu#0#`0+f7kQ0pnp;Hv`4y2dON#ZjVxxll{DP_=87iLuGBN_|SRn+@W4T z1Ez5AHEEQ}M`DUjGQd}9cf)}$!^v>)RU_put=8TGYfY^kt)v$Yn1rO@<39mzmPYqb z{z$K!q2$=@H^$><+@%+~k0kMmJT&Ln@UBBIWIxi**C0yEXIyaUPmk-jzZ~~p-a00~ zb2nNE$jMuXCctCQwPcNL;h_chfSI30%kz5_xnj^WJh`mfSKnB8J9o^^cZ(&So9MEt zoGHGO|BSHJp8?YksL9==Wf#c0$47YM0em4daAp!-ZIWO? zuv{^n(Q)MCZ9s8b;~FvU@qKTQTuR{u6Xnc>(vA&Q&k81l{1N{L997y9nJJ$)l-eo8 zB`V*u&FQ>3TX;_png>N0xxuR@Un*kNFjs_eZ#C z7RCzF8W$B8}pDCR44f~eo&c0omW`$gpLq<)5z6)Z(NWzw^3 zCA0)cEiVwir=y~hVa4q0Afuz)Pk<=|K3mtFYhyyHgRr7)m4O^fUi?uz!po8-4$<}l z$u9kLa?_EJXDQN>zi1{r=V#|fn_KhN6%Af1?mwjXD{nOpp54i0ijm|fmJFkyiCH72 zAY%s5fK<3=t`^O^=f?l$(~ZMfeE3+>-6P~$fSmMp=~D>wgn8+usOg`fHi#|O@RgGc zV-kn@G#7sf+$Sd}V~1U}cV68cSb+%jBqFtaR2MY1Ti0B(;0n@CQDfaS9y%}dZ&w_( z&Xc&_%G7(;xfu#%z>sVH?!V%-|Do;w3v>71--hZFu-t2+Zu#al^Z)s9ArRZ&(eVme zLu8)8d<`cjxU`+w5Pm^t^1q671E@I&f!}9B%t4?MF(&!zJS5Dwu7gMOeBXrJ=0~9{ zgfIi}>VeV!tjE`9l>s@p2Y623YBY`_LVqFbLnu?aCW3D)msrF(pRtl1+XJO5daB$wp(B6CJYnY@xE8qFuzXO$g(Yf221+h zPFJ6byAiN@!L!gIlM7%eGhrz3Pa+53?aNqAgNa88jY*FHDqb!k344r?1P%%!0QGzU z;MsP5>YwpjggF0ZT;+8R$p1kI{J)3&|Dg;1ub-xTJjO1XZN7LVI8xtxy`zK|LZHb5 ztwg~2@1XL;u3rj(+(=P&h#{d;*KzUP>#jmIz0UU01a_FNUf%ouHTC>8mjyiAp&vD?9w)e5}WS zbim2F0Mh!N6VEKkx3{?2^?b~SKv)yra#>AERnX;d$Z^f(MY;>TWZkm>`RYSSxwe0L z@vCPF&eS+qmYmzP)hy4ya&_|hbVpjwR@2d~Ckx0py=?E0Zavk!IIZku9^wKOYc!4ZvtUAQeg@-JiZHMbIB!}m%9tc8Qwha8>Nqg;|27DG@eq(5d5{k-bgracx1 zv!m%wsPJp!VE!mVM_5NzH`~U}PJxb|e!e{_fGNXlFt6tVG~tI6{4rDiiF1<~baASJ z-YhC|ZKy$&tosI78Ma;KUf>)wU7C=c54W>T2*JNQXl0k>SUdd&?%}{cGK5Z zmYeoTU;k(A5}?(he0;xSwLm%%y7=-d9{tMiRw2O|cvGgeB4Y8e<6Wef0@ya5(=0e3 zm~QN%zgqI2hME~%v#za2y8T`bDb68dhZbF$=3EUd2W*)k0{>p6q=H0I(@M$Gf6q#@ zgu!Tko&+37HRegn|TGT3SWPpiL|mGC4U}n{=&xe0Rqu#IB7t;5pU*wQBu8 zb-2KW?;}B4(DnZXxEA~0sCQ|}gi>R3bMt>PKdzzB8AIFaJiLydum204_y1{t=Xjzr XR-V`7z8{#b`&X1zlc{)P9`-)~m$S@i literal 0 HcmV?d00001 diff --git "a/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/local/record.txt" "b/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/local/record.txt" new file mode 100644 index 0000000..d04ca3f --- /dev/null +++ "b/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/local/record.txt" @@ -0,0 +1,13 @@ +Ի DedeCMS-V5.7-UTF8-SP2 2017-03-15 + +ʾ ͨ /data/admin/ver.txt 鿴 + + + +ֹٷṩʷ汾أ ׼ ©汾 + + +0315 汾 admin-admin + + + diff --git "a/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/show_delivery.png" "b/DedeCMS/DedeCMS_v5.7_shops_delivery_\345\255\230\345\202\250\345\236\213XSS/show_delivery.png" new file mode 100644 index 0000000000000000000000000000000000000000..45414ea333bf95bfcf6b094d519ff9b430245ac3 GIT binary patch literal 21991 zcmb5WWk8hg_BD(kqEadn(xIR*lyoadNjF0`(%mH>pmcXg*U%0ybazM%4I+%h5CX!` zJTs{0_dn-7?-O6p4|?DCbzOU}z1G_M;*+AhB<_9E`)FurxYAN@l+n=8*^z%gx_bxt zGy7AX9~v4pn)I93s_yAK&DineQyzQgYA!CLA0=N&p$GoNkU@X4_K~+;TK%Fe(n%Cx zv^^NH*Rb||ZO!o2UR`CJm-Wa1`_Ma1R*Mhq$B=suvIw(a1gpm6y{8X-xr!e75i@6E!h6tZ%8JYB8 zOYq#gjtm*pD{kJyMGSCeP%DW+Kj_(dOsa^w%Kz5~zmvs_VO z{W`~Q1usaL?lO{L_a9z(qRI2&JWIl!3=pMKCrOOxR;~2W>@g})XA(s|e1P9^rl%{f zOy}nN3K^N&Bp#FTXKD%fE=qK;v(~=P;m!E+QBY*1Z-3hXxys*f13?TtY(Kh`sV77N zNgp8>w$qnt`O!sSfey7!^+Zhwmlf2ToO(2wE0e>fON9w*vnca;D9DByFY>hKQHOX= zAI!y~y3bMp+SkX^@B+g)inCUR)%@3#P|e}pDzI~`3?MHwu9v(}WHQ-DpKg9Mi+ax0S!_=?q@9`goE z&we2szd839V>-vV&BDU+zbhV`o;|eW+DQ`4dJLclpNCe>S9%T!lZ&;+k3@#_G-+~v z?mMXB%ALO_S3b;6gK+y;>XXLf!JEWT806qvPX>I9qTM>{ zS$-x^@j%c{nVCTU+(cvH)st0sI_&kFE7A(C#Ri4dB%;DX|ajY3y737%cLPX^kJY{Q_Pl2v9uk>%WnOP z{E>)gla=gX@Edv~nrjBz%PtaV1kVyL!%>i9Lg&F3O*Vt8t%|F+dk*}txk|%k=e^y; zsO>qv9mi~zXyF*IH$sgK`mMgrw)n@02*dVwCtYQAa-}WySHW^=U>$*4JGH9@Tr$&U zNQJ+z)#q#-pUX?*-G|e2U?;B(m-C&hNv{&|TAkXKH?})lnXZcrgF#-T+K88iKErvt z^Dw(K&~~-_00BocC(s0pHRxevR-@zIC+F-|OJV1iBIe^J2YDZE~4?2f-8Z zuDci(V@=tSf%$0rX(aY~R9#n4@tY_o^>b-g#G1+tz{;nFYQ71wPLyUzD0EI9O$}L% zrBie-g?<7`D?n$w=H~31JRmwt((o2(2z^7Z1b(y(kLQBfcg!?^Q0>C(h1b(Cz){ym zMf6)a#)MG7#us(@V(VTbx5uDv=O&V^xjWpJGn%s9vChuUlf5oUvS*ye>?<0K$nR$= zRb`wNNd*FkudcXlmtICrEiRVzk^(`Y_Ln8ZI7Y=z2B8V*= z_fw~W36tPKeu=D0evub;JbqG%PcYU;MlV_&p?(**9>ZgMgBmU1H|1IgEXU2#r~$w8 z`4AXLn zMMRSCn4jG;V7vvd5Z?cECiLAW!;mL&a7t((Cm zE?KZv$?863q5_2YV>bGvTWG=Z!mfyKBsi4ho!!xQPQHxDH`=R!3m$gX8w{JY<-{X1 zb_8%in~V!(KmhV?86IG|-^er#eNCM~Uv{_#dr&msqpk4a-kPePDdqt7n zz8e5%m+1V#oJIiKiq?nNhBaO3@5cB^$HNn{gqcs>S~c|S29$vAF`(TOVvp|8Pl!nZ zWv_WJ*lR@U*l^(L^3U|LsQYGT_d7~-v#8s)-7~?SXzgF=(Z_RxrYZB`8vOblHIq^REI;A;)Z13COQX4IpGf^qq? zMD>NBIlSdMC*ZO>%2SE(1iDVgrBHF@vS9jUQK0v3CHW}?0u2+1>rTov-ecE#YMy@7 zM9v2ocXO-YCaF(6hv5-Hx!Q$t0Ch{ye1!X9ImMCJf>Aj7?Gf9Th_$Uj%yI70igy3z z)E=P#nAzHgI&}Q&we`CYukEd^*w&McVJ#{+k9Em3vEIa~{O2V_mIdQ#9fK9h%M%VP zYy|FJSb>}#$xD0F)wu|lsIvy2YhfWO#7v)KoJY325{q}_d^o#5mr2{4$d^{ijbwmE z^{&DXue}z6G;W(oFHs@ct_}n?Osmn>rs0aRpLVbk-K2wx?ds#V@B3X>FW*<5JgWUR z-p+b!Z7L{LmXzpGfNdo0)1=V^_S>3ah% zhvm8x<*aT^RW01M)%#q0%Oe>6UfXcE3P%3E)8i-li0A8Vul$-@NcXB{-Oyd|>98%_ zQx=3u9LDXVW+bNZ2QZ=EUS(y5HMkv3YzwSxwZw3#Ez0C9^zVHzZpWV1)b9)1`*1D{ zafEnTtFvezzU{C{s2cmMoWoia*uJDy&7m;Xx_Xi)PdyFT3$W{9- z>&=57lD+sT&l`nPK27EpR1cP9L&vP5wB3m@fjH+p&(+tem%?k|1T1y0r^b>eCgEk$ zg^hk%+ZLBu`#Fj)0|T3rLYW**+&=+yOm?dTuPBv#HOl*UA3898B%ZaPjC7Zr^Qb8( zsVL7}?5Ui|KBqq;4+%cryv(Js0ubw|_%Y;-1n@{S^T=s_{nqxrg<;yqA1imZfpx>t zvPp91{?_K$<;dWNdiphK-&WGSF&_pU$buVsuy`!jlqctKOX4d~=|qaG%y-g{(l zCS1QLlNd~Ov?MTY^?pQx%7h47#+?}_qPUIkG8?g?dLrx7%tf*C`~;d|($|WXNVI|i zx{QbDvBk_NWLCvxeccWCu{}&zyenOI=CXS$?fL}!+UDvV;QRsjD-*dE@*dANQ;HS@PS)1FOeYA-LII~_{Q$H6cM|W4|`*+Te)rL zbXYZ(1Q!YqGwcCfKR$as`-tI6w)ZfTvQkmLiz>UZKLHzngKgI&se!1Mbk4<1J%24r z5ZP{U(l^|=1uIE?`@R);Qv8%g)+UioE$u8Ohv1(^9qgFoInjB-yi?16-i@=-jiPqU(Fa zet+Z97)@>R$Fh4eA-AmP9&8;g+UpNdz0@l2JZNqdrd#&mvm4ndpenUK76Hi(7NYc0k{KC*H1v`9W1ZedA6F8#>>DE+)dg<5Yfyop}Dr@;j_qx zauEQxs32a03i1x7agiUCP6dWCu5o?wu($E6z4{4D=iVO6iKT1cVc}lQBCoF0Hn|-m zC356;*GGNYb?}DdtvHc0YnU{Dzn6Ga|BZ5=@4Emy*>XjSw+52AE#&E3B|GNt+kFJ7 zq!Btlw$^7xt8~;^27Cy{T($rwKX^v2tw_Rn7yBN;s4Dx@5}heDirb6P;_3o5Kc~6K z05}*D5L>FbLV!E@gSPt!#_t3_6}wp7c*r3!Q_IU0_^#oAcFu*>L9pi1abe>cPfz^d zRlsS!{;3$`^#1bki%#qZNml(8ep1lpZm5R55YF)4!==0Nrqy0Zq=ku+-_uN1xr4wV zYIsjyT0#Aj;gZ~;LP|j$;cfw8@u;}S3b_XAu}6Q>B$2>Pbj^@;h}!aJhl$FDM;1vf z7#sW0M2tQJkeL1aQIEuwuJwASUhYeBveweNrP{`;jAZFWg>|orrHu5fQ&gG1|MZ0d zy%MKda1}~4(3`AG+l*^&>@Jm^XJ}yh)oU+4&x?S@8BP;b1!GZqHq=USHp2LU>UI?r zRk>A!hNeU8+hVIG=5)3ACr<|#S3f0|)>XLa>{9vVYfxU~U&~y*y8~dB6y~9?%P<&) z3K5mhLyWx^KUTe-I(B+PtbgFkmDwL}H4jxXo}_?p&6R;Z4Sb`AI9b>X9YP9D%f_#p z8NxubW**HxmoZM+-=jcdU~G6VW*Aq4YiFhPRnh&UqN_ZCL?r4(xUBuG1Za8N{-YJq zt$EY>j<4swXz^x>%rTG`#t}V)vXIEltp3q?NKNF_eh?fSOsmO9vOE0{KUYkIfOB!h z%T}t8EC-n(JAIzVg`@rB*hvNdk|IoXX2Ypb7$${aSF@Om@1!Wv^yRvi2v~aeP=4c$ zSIi(BC1Nr`F)_xDKc1NX^FIftF^3&9DZ+G%Eky{&?~ZhGA6vA>&4wT~(|FaKQPOzu zwy1ne^o;~X{TL=>s{653Dx#;qK?;pIR`ECzW&&Bg_xrz8Oopl8)MJ@!h5Lzk!MMTv zUYUjG_BfZyePM)7lA+@5zuH{;%=0X^8UAY1zEq|}o_aT_#>5<@G)e32%2bh;S2OSC z!p=eT{PM`n=;C+Z_?+&x>ru=^jFMT<;(>#zZGj$BD-(M#ZL$_A0nbX1!+b+zNWspd zeSWJvJ67J8FLOS>!f>`k%Gf`f&ZPm0JLr;Sl|w$U-7z!y%fFPl;X`R~FdH}7ygSVn zF>6u}`!7Soc@kk|#)MxcdHZ^diO&D7?)=+*VkknG8@3y}lsXmVupGkf%x=&eW)T-U z+-0HSX(3yWjNC*js$=73PC-CeQhM57ZC(Np!Rc%eS1pA)H={4tSXdip)r3Y*>yj`g z4MM9{Kj}pyBkGgON&bpz;-Bpq95=I^!=pr8T9+l^OI6 z)~$|zRuPRQ+MrzgZaE>->WXFu^a4p|u%IdC=`42MtKxq)n+TW-sHpH`yC0Aqq-M3% z)Bcnr$36|nknzb{5tr7V9dwT<4$lF}H;i6B`L;w81_IOs>ysu1VH3ZAuS?<$=5)(! zf#`nBO+mJx|^K=8p6sBs4cfOYHD@Z0mZ3Vo_la zrW=Isz@zS;dM^(6rxh50sEf#H+j{EM6`nR+xUdjU=7zE#*$L|xNj@~5Apn|~ehOmA zLpnuG0PSOm7lcuR*sM*|cJ&((X4eiL7AK!)Tbo913>1@{KkH5)G@uK`r67B_J#F(; zcbES^4U~aL@Lv-ONrX&^aH^>%=9w>;hOl27o2NT8r29Y}UEItr|2`<6oxReLO|>{T zdO8DES+W=8Ex#-SQ}h%8&xHo<@a zGltb^cvgBrNznWGLUvSw42b?r(f)|DCndSBfVqaDA;e>rRME<~Jvkdw;FO9bO8MLE zG4r3QDP-093RFY`k^d6lE5%aBTi_nq;?o0IO|tcv|;jz_i zho?0Bnp(bcfhczh54L>NGxs)?G(|PNrHM@*vDOA$@Y=xOteXFrO3)hgp|_#F46;XX zP^K~@XO9At>>f_oJ(f)G?H^BG5as9Q<}QT<<$qCtZ{N;Bd2Tnavy#_bLWU&?_l9Y# z64~?6WuYg2)|?SxGcCnGdT*lf<{xTxAB^D#2|ou1ln}lMG0ot^XGOX_M>w1|=O8vO zy>Ii_k>TOb?`~?T68wE~7zkpN5zk=eiBti<--WCg=9@XutLGWpn%iT(g_YU(rJS|+ zgLw+tY)VupAmT~`ERPPZbaozG9FAg(E6si#&zFHUO{cR;MzzF3xEY24b_VwPc@Ntu zd#tTO;w5m!!0z_7Q6CM+UtW7SkcNCac->V=l@%t4%xQHiU`5k~)9K~%wGXh_^Jqv* zDKzJY-17Am0@iZA8yB<=7|=U>5; zhzU6H=)@Sy`JXdI8o&Vy^nsIm9^HBO-9gbt%PHEvZ}S>Dm#$jVGr5~rzV(DV3$^*!z{ldI>M7Pv9MV;`C^BGIo&O z{&*V?X=qnQ`0xe`_N8%{8=YF=1Z{owEtZ-{=8HmoyAbNz8N*P=v6a@|#nF-#=T5JW z+u&b@jIY!Y3(C754?e6CnRIwPsPH!^V?c&+X#yZLr@9nSi~O$BN>4VY%*gI?)qL{c z)Zm0bo9!BP1#5P3ZebO0IbT3I{3_Hi~b%wS~ zZn2-+%N8PrPve$tY=F>TA znvfjgA?=5ik>c*a3ZG>yK2(}hNj@;1i6btwA~n?Em~YX0us&C0baN^o1}eYsOp?%n z&)+^lepRcbSfLi*$p+GX1GbbanF_UC4YJvGQh#{RfGq}d1TO2o!n;Z8|MAA`?CiT? z%(oIb%-?H7U>VaPGa41~4}-a~af8CJIM!FtBT!IQ3I_F38OtJ9sPwZ-r}|)g2o=mXisX%SAcdPB|gaJZuG?DY;FHt3`Mz0KtZL}O{ff^LPhj98iCNrDnA)) z%zS>`YD>4GDfE{2|D4j})Bl;$l&py^&s9T?WyDi^hCKcw^p%%!=rfUxtS*jI%dfcB z&m!(Zo#hW-^#xLs*HIHJ#Y7s#-5?nAKPVs!q8v&uG_GP&dl8adUXv@Y# zJPwYeVBPZ4W3^;{eiH(JVW8N|@Hs(%rL!D*eF>fZ_Y@zljXOW^L6qBKdYTfp-mWzI zU)}NyHE&SB9EAcac0yJ+1pq`E-YH>X|84#Vr=v256^v?|OlOiCSmhe3es?@O7ums4W6rIWlj*v3K z$FiDJ?+#S)LhzOUzLjypwFgPZ9J8At-Ya*=|VBZv5^b86qS3%XZDJ9J9O|5ca?bJf}UE z{P@vuC;HKHow__TW%^F2zLq6fa|k-2Ji2s%4INXx!q|r zbqn&WK_;=2;9wRm(M;9z;52&SnSJ<>4q_mrDXPB&LnOMP^LFs?`5qDE3L82)6PCKhB*(yL{>DdoN-!7gD%>SfYktudP>WWgC>6#c^;8nOHSpyUsQs6_b?6}8=d1N^S#`aR01x8&#-FCBf5jxa|s_lgzuFt=Cvd}RAAIRKY=Y1b!otbZE`Wox%~Wo_Vw}=dQ*260t&G%V zankbaz^D}KQlk%pMz>h?%ih~juIp%5=wlSlY7ucMG}Ots_7@?(S7-P!&D0E#**$G* zd&OpxXS*+jr-J|j3CYOW7?-Z!C6RxO5_cf}YHC#;H|6HH)YC2Kn&qut;S!%SvO8_Z&a5_>Pc=h zKKv+naQFBbTIm?GbA|Vn?V6R5fljSNx%MUSbj7%K{%!fWw$*};S98<#A;MB)%3snK zSf24Un2%aFX)ji?BF+10?9QV`@pqj=QT*7VF6ktHX8}%cipT#6%8U5ax0~zpiyiDE z7BKB(lKRTa$96N|tq-Pz*rlTeyBcI!PEE;(4}aZya#Rn{e^&aCIFL7ym$I;!(nFQ9 zTf14NBxN_DTsK$OX!7DYlJRH(g#jrgRi2Y{#-JQgVMQh^R%Njxhgd7a|#<@ zEVcrYc*C$LNl!t}K37T*-)iB{Q`7y+SJbhredi36{KM~;JTz{~d{6DixP}t*69S~J z@3W){OBI;i&91t0yCK##2BTC0!`Y?YMNn|FIzuFy^`bf=X>2vCwN}`1Gqn*4Cb&z0)hPE?y9N#q=$vNL&x5m@Y@NsB zHV-a{yog+#(^He!Y+M+ms1enLG^9H_CR*xxGeInw zw_Ic79Fyty4!b~F;NOXVi`#&p{cF|hKvcKC$}`?RU0&-=W|sY$`!O%-0iHx$ZlqLS z)8yDc^9Z4$QeEBt7mUslW>EC#>@)Q*j@Lm=8F4wPc-;sm7wr2;GAyU3n_Nt^IoV1< zfk|vatM=U7?wywJqfY!wdd|>)(uf((yX`7Zm@kIlr?y2c|@Ijr&f8S zE>Qt&$&lq>o5jIyJO3EnmMYKc6S4=4T1|T(mO0c?`Edd%v(^{h8|b>)Hv$^+6E!MN z`7-7`#0|IEp73R;!S@(rO^7nb6+)3%sa4T`E3C@H1M3)IUuRtOWZ{?!g0WY38~jf( zlJJjdSOL#@gd3w-Hw4BvvQUEWH#zKB_C$&U&Khq`u4I!tm&zM)0r>>Mgg(Vn#>Xqk z@_T8W_v13dABP2O`hyh)FT~~$prAi1|HJBs0Tp$2uWZQDwzbXN@*|>?lg`&4U6On!D0U}yWg;j#v}J&raPH&D)m@wld~;T*ZW?|N{9cg4^1C$ z2Zv!1sYo+q+~bT0N@Ju)d4|ZsfTH|`7TDEL)S=~O_5a^d+Q$d}T6}121N%)nJ`gM2 zkJ1m`sEi3St_5ML0fH=P+H*i#U)t1gzy2dqelyQ05Ib0)xYRRvm;v>AQRM4W)NT+0 z9Y>9E?eNi>;~WYi07!33eXBG1Tf=KT5aq1W-S0F?B(!Q@zuz z>K^joCz{t3g0W3<7NGZVAFq%g)AcOh8B{w~wJPp2EoCV7?B7Dyk|_8kP0^j2<;_@V z4D0?-3#l{4A(r}0meZlKybexEjoTUeo4lbc06#eJMsro&c@5U$Qdf`;kI97-#t&xS zNO1Ksb)=#DCA&A0YMPM2kZ^_Kx4->AlVy5Zq^K4b3b4Oa&K26r3>V=}JvNegmxF2w zK(}jre|0j{qr|ErQml4AW8%2Ua^q7gO)mc`PsSd8#t>8R`=9rRQE6T)V`_XXnCH+Q z6Y~(01{eFE5B;t8_3W10?s@%7uO3ZCW#;{f|3rOn>6`e!VXqr!Dc)m6`b|2dy=>}a z^F2Rf{JaDw0$^L!WBV!ER=>kEWXma z9*aTQju6lu3w6l9cKr83mXI9kLw6$DU+nJArE7>xg)kdq`?| z)u5vNAA2Z;@IQ2G#B3m}Vr8!VyA0d=XyTYQY<_G@_5@LkKFrkeWE{e{8wPPBvPvet zVEzdbSAQ#Fo5~2GjZce_->H0AGA?NDG8MD9v7nOD@vkWVQXO!^P0%#?GLuxW?~Ml~ z4|x^q{Cl25*hT$YX>{=@;qL zh7Gk3_#4oiwnRJ%#^iErdg>8Z_h2ngxm0@7{W+2X{3mz~1CE9bzCU@jn&Qp1A<-p& zPG-Sh=s~^q`az_2^gW~(UDf}emGj!Y3dFI#scCI|6yK>h@p@z$>24x>gL=PYHZ^T> zjeEn+%40f$-~J0{P&V2W0LN5RF```h^Ptq(e{rc!16t_*f0F-J!M>0l;1j!}b8~0L|O6}l*bl=bJ6FF1rbP%d)q8)%$E+Jc8dd;J`&3=^ zMy-kbFaKDhkyKt>H#Df-iq*SpH$4*OEPuISlK2P}gm0mPl6WWwda^@2>;`M{_g_}p zi%yT4{1vmt;Hn7fwErz0{C2U%sMNx+^v_$sj+Xo1tVJTJdny@N<)=A2>dk6>nyE*? zO5LakWdbS)Uy&H2@IX{{C_ky}#+_FGx!^R~A0R(J`hk!ZN$Q3pL%_HTXSW~RRR11} zc`#n+`0SVk^HY$^gJ9Hi!fyP(&JesCJYjP0gzJ|wv@s5()EKU-uC~vReE(2Z0zpT% z$oxCHzkP2X@~GD|PDKF=GkjxElHQgEX;*_sfM1^8><%e?`0p7P^xGX2*sBVr>m7?iTDc1Xrke~+H@VkLK%nftL)?MpLxw56bNSlX^I}m5iIfe@L7;Vkz46?l&4C&1& z+T4(d5@e;=JHZ9ERI1o&iz>(}^WeJ;Ote;Mwfq|P%jBTzd2yqnZlRk-Mm#2bACwgR z0;HKFM?>|l6=?^3l?-aC{QMRcswI`|e#b{O-;oRNYroY^i(`tPNL)?>D~bpfKB16% zYvN5E^NW70!9oj);rzdJf<&b;&b3}r#gwEpysG6eV{hXp^ZM3(G3}}bUoqxtCbQJg zn)0%GqeF*Q9i6I;Ix!2;%jog;v*G27;lxQ|;NdWG5!h9js-f}y+zc6@&v^v>?xfEH zLns$GgWR>gReKmT7|JS{gm4)maZdCB{-=%y#Q_B_QmSC1gC87&4c|lSwjM1TK>9Y> zz5s|{=tclHqS8L*-;sKHIKr3|>gh|gl?mFcd2U&d^DvGwo4HR5#Z=!%q|VfnD3npO z?pF8wYy7zfwEBH^b);p0mWlXwtYnunx%JxAwlvF()I}fOWoTeT^erk0mdNyxFcErt zix%KBAF{H_f!T@_ zbF73Gq#Wy}89`eeYy6nTL+@HMX8p9xLt5s2hp02Xdnevm{MvMJUCS>po)@n}!qRx# zfbwD-mk*Kn@EfJa!<}$p$jUa^TFd5|PmcZ)_hJ*X`!M)-kEi8{tYDzS{Jw0}10A+z3P*9A0+v^%CLRJho);$4X`VKj`aeMqw!?>c zuyML3OtN?TQ-#BF%ourEd$!@yPrTRd`kAqG&H^1rSLVfS&%{mz;?5d_{CLc+_g2E& z-3II;G8Lz(pocwLN9?D^fn=tpVQ+=?Zzy*nekqm%QKj{Rr=c_0c^H=oRC8@gU{6r@ z7rSLW$YG?yz}K(Q&WPe+s{Y6(4>7J`TawV6UtNkB5r-U@cAmMc4g?ucSK3oV z5VKEX4tm^aw^T1TLnNEfj9OPA=b9NhJFIA-Ek0sLqe{)(ncD7yP@!?2a^18uFTp9z z$6N&B<7c*U46SD$bQ&E3-{`kU3tx2Q)7AlE#rtuxw4Y|h4Xzn4dn$5UyT780E)IyO zh`q$u$@e2E19(_%66kOY=%Ioet+e1BrBU+PG;{3-hxxAs5%42jW?Ey4b{X_s<2=py z$VfaZnkQRQRZk0DTnDb^5rc9(i+M^t2FL+6gLLb~Y6~1If|j2JXpt@G7vl#OY4^N|HZ-$FI@X)*lLvC>6w!ku0TDD#>seh_iIScbe|8NJ|ypNU8NgH|mnX zW5XYp)~h1Ed5|hPd)aH;dgA!;(M*(^@{%NnO6Spic` z%gto{70t%aq;6?JxP2qvF zZv3?hgpW+H+>%ViEUgA}T8@s$mE`8>_tjcfyZ-sLs0zPQKuHpu@N|8TGJ&aFlN*ls zs8PBV20ArVnw0%OMOV>u@OJP-fBA~$G~N5v?#aH|L4v7%%xdpjWiOD-Qp=i1FJEHv z>en=r=_>5CPW_9j3nh%zVu6Z8fu)mYn;r^umxLCEV{(f_m&!Od=H~s%3-Bd)N4o#Q zQgXT@z0FH4QfSWhVxtB#y^aaeMyR!0&R$143H_~-^7>z2q;Z2Zpjmz= zqi}#`mVwXNhydqZ!b|;n=npxvc(513*3{?VnCA3n1P}6BfjUt#7ks z>ffoXRVASw0&{@zr+5u*3VGCYqz*gAxHtkr-$rCMsGLRII`r?kw3~aTe>xsA%&KLc zE@;YK_f&y%Q(!GZe=EkpRVEGlkLbJ4FTf8byG8kMNFX5p{(|Fl8qYjy#$jUH`}cL- z`5E8P=PG>zZRzmGBf09`vNE04GqT3roS&$<+;u3_0%H8&)qLJ`IJD4meat`aVXFiA z+3|t*+bTaVF+c;a*U@76@Tk6Lixbl8y@0QwR2y!rdlE@z0yo7U)Wv7e?7U{gvb2li zBF0jVK7<_+OCJ1us8Svj#J)}s9Lw%h4jnu?GqsCl=&t7XJMx@83Et}$!pA!E=VqGj zU&t-3kWe4TP6WZtEWB-NbXlt9(~$(`VMDAIH^0SfRzGoLD~rI@71a^x$rAMIlF%5l z2D4LGJWE{bG$NsTVr?u(@CX;eqeas!6&BHbeom$%T$&)z3b;NT)%a4dQ1!$3qszf* zassLYpW%wG-!hQw%OHSm^kw-)cws}`YwnF2QUV!&VSq6^4K*=4yCI({5oJ8jf_*Ly z4h|#sx&YBx=Yua{SCtBWXA@h^w@TdZ%@}#O(S57IYwj$UFShf4NI)ks$<5H%z7Vo2%fZUw+BHyT=aCYZ1DEsjG85D zf8Es)&gl_8wE;g%(nu=cEVXD?VU6-(bA$#*V(Gbwpz?v!#ZO!wIXH4y(?tO~gv3-8 z@UbC91f)k{_d2I9@_bFQ2hC$kWiL)a_m}vl@2JW_F~WvGfG4bPdT%?CAQdz8>5uA#Lpp@_hw5=u#n|+5VK0abKz|xZ8hlH+CPS5Uh^)Ka&xo6L|_AH$O?dXADtgc2_|GD{=zsG@eoE}8klXLYgq%Ma4 zSDy3bvCd-Wf)p`)So4NO%JxcxS}M+@9D;bzJHE@z1ju0NJzR4cH0%@={fdk8AgN~` zsjCL&zF6d5y?aANgcHS_#>0d?aW`-|{MpOI{GM=Wtz0x(IMFt52xmEcGMi=3%1QLQr5 zGR4jN3Tu7~{GQD`SN+$~+Ex1uenvH^i+he9@O5F^Lr%4@W{$(3SW_pmf#XZ4L86u? zCMD4AZMW!ibfY6F654FO;Bun75(G${_l{ubMg8hm^P^1#zqe6kx{d0<{a>{FsrQy1 z3w-dDy4oHUA+HfUI;I{V5vv}fs&!q|+T4TJ=?dIauh#hpamdUbbMzocEJdoc&m5;h zw3I!^t&ye_z9*EYLxCY*sA~2?k_NGAb)Qv)jl|UHfJLv)b(;@toO%urwy~u|-vdv1 zPJ5TUU=aOQ`KyiTQ3_Lvi%9SDeX)Z>1}~Ve@udF|6IBzCg_}?BY)SV(pUPW_e;9n0 zS+DAA*SXhMUEtzpg!nl92GrtzYqrU>M#v34F$^R1M8M(T51exh|&-$Gs+h~5Z}Ae;R5zFT!{7oV&$Oqj{}Q=1XGl>svM z*@|`P;00hf=gf53fcL5#JhgiFYyZ(3+xq>20+=I{V6ILimm2DJT1YEG*P~aUBApOw zod`G4l*DU&YM$Yvt^(cp;WYEu4JN0KFvu=tD?_+5R%f2}N9C6eMqGR@`gF7;gpk=y zb?aALnMDd)MsWEBfANx6tGCB|H>^c zDv_l|66w%dtQPOY(7WCv@bg;@z+ynF@t8h?pZ6m%w{?#em6v@-y$GmECwhH+>>a4h z1eUr%IUkq6Tjvk9-D!{pg3g_hvWq^4fnN7_OX+=^c2^hLdm056c}&KQ@tGWdFzGYv zgN^`XL#r~HZ6C)-k8S(jE&jU=ud~$DfxHY6F#ab*dKLg;Aj3#bQA!`4)eoM+lpncz zf7GYdb{D}P^~r>qbqE54rfRKcOugv*A!&)QSRZt~K0RfTFPT))4wZiUCGv+(%FU41 zTmG@sLjRZL@XrsTx>-UJ&K|&}mj_qDfr@*)JHT!ECAD= zsvqD4Y0M3XL;I_qTQ)R!9x0y=A+n;){f^|S9ooeYb<>?U-KA+&c#3i%kN-6f)@Hzi zG~0c%*b{$R}$+Kf2tL#>BGeI{@I}=1SFQgf8Uk%39>I|`)k|V>cHeqdgLA|slU^7&qrSU%^*iAxg7kKqocE&ahg9C=gsuVElxet zSAn($Ocrk{e@}%9?1#&(3Vob@RS8w$29~Nf1A{|C2y*kcHC@9uEM*(-xjXXd16`F$ zq#AQ8F^%s|r`Zwhjv<;Sr-gtV#($^CIGElOe!zNKUB7v0c+_-pFy=6bSJa)S)M=bV zVUPcHjk8^vD4r17x33&P*k4MQh`a|}lJqtbX3@Ive2@d=xTRTf^*v!|QV2M4^Gph_ zqlDl7$ou$}C3aWj;7mL6Zl#dSh)_ifn#o8Fw(y+8+|mYmG?#!7+ele==Lwob18Le@ zUqKgEq*=x#0Lo>h;%omAms4~Kh5VRJy_s3lHy`C-pnJ*t)22@Roo_#C0;`kVS(}=b zg;yESk)2DYkDPR@(4|CqR;B+wvnHOeEUn;rsm$iV&(Gf#gcl{mohnh6$Q7MR<@N#< zl~&xE3WC1x2l0^2vLI6|bv;kujcM=wODvoCo;og+gXO1BjgpfM8;R&p6ek^n~q8bP0_wISwBSM^29G|O~c<^!S#$rP2{9x z!Osg>VXN%oOfd3}u)4x|W<~EqocWUlVM1WT^QRyhfZqF0^aYe{eEedYq>!TE3~HyRpYBI@@76tI|7fhsRmY7EJ2ey&5wmxS+-&G$P?q53Do7Ea&<@w!Ft}8X-EHymH zQLcMycNgmQ3Zh8dIP6pJm2LrPLz)YpG~=e4jfYKrG8q45L78DDj}WWl(WkcmIx;9d z=hs6vHrc0Gaj4h2K`nQy{kv5=9A`c#cBm1? z5pg^$F92ybHkhtQW5KKTs1k7=HN+sgoh7K|LkL+|H+%tEu%HVhAjWW1$H{Ut$ z5Zzo&c*dYzXFC+9*qfrlU%lFDSHFAKxw!O0ndhf$Y8wkRxb2oer|D@pm!3R(bNQ!AJoU#d&4F5e zMXZ(1L}E@EPX{3j$UBH(ZsAM0=Q=yYXga;2xXbt8gH^}d4hXIROLcvNTpf}@{XSxo z&#lw(Zl&8xi#A(EA(_ili%#QNt0!K9T>rwHf%^vi)bw}IaOpWy3^-39slw^|AeFFw z1f1w`uy=>37IGM-^k(S!MFqZj?-m@cL1a?+SfVo0bZ4PT4v4(4%Piow%ZA_F!Vb`} zS}kDqwCSCzbf~G0g^izN(8D@>dr8S>NG$B!dDp>mU4g0GN{d4xtxx_l1IByXg0(}rMB$6ovsTr%!Y zPA&$mOw)OxtCBiC7JyGu%`FQ;wlkFu3&p%3=L)3k zY|6E^;GTD}DJJcTosCS>U8zfm(sJNQxmg&`2Jv82d3RvN)dJmLnLZ)h0isx93QDKBs&8E9+!hP>Z*COWN3la*E3qKG&@#(M{8 zD=D6~xDYZD5$^TzLZnu2E8^pfWXbzvkBB(HZCun9Mk$$zx0rzCCO&dUmv5myB+IL+ zS;mbuEcM^ePpADZH9QW}mIW^*-sco~OwmON(ynLuwbcIZrrxhqA|N9+UZvb-wE@RH zAX_z}`R+VUdvNjQy2(7MkqX9U!l}sR8~t6g=9}`})|2*<-muSM`80}Z#u5wp@|8Lf z2wnoBfkZ&kQJ-~r4Og?nAumxAmo03icp$-~{e8QzJNtvDO%AIC?658P-ZXWQiBGmR z-abFe-GQlQrXM7$(&E2A^V{i2y zp7PaVz&o&6-obl-bW2$+Q}rivi6)!ODWdH=`;bw8WuOSoH^R$+6Pw+R>5{ zb-deQ_Xr&Lu|yu@WYv=k9Pz(GdR|t4hAVn7qQ06 ztXh?n#F4-ACB%ovl*Sbu-^u;4d?HsGioojYXOR+dm=^c;Uj+8vro2aj5doWP z@$t$CdJpV%)QkTzO*{axfpa%Y^3Yl$ujwD1&E+8CBS(?HMFGW2tZTe=lUdeht7Z~P zdSs|6Hpr>7cWYYLc39oWtPIOOqngXM#E#XJ!4jy;_9JNlHqM{EC3(|f8vh;ag8;fGeu@^_k|@tSs-xkl(RBd zWpO?q`XQ8qELE|flz41}fPl+&xOY{l%vIJNx#ie8@^&bSP|nw|Ju1RU3TOX-lt4W; z(?(2K$h#KN=~IFKtCBMhhjQ)Xc#b8Vi4nh!k|J6# zs0?YOQVNsxNS5px`#z#KlqJj9BU`=BJrCua_r0$7y58&g`?;UxcmICR{rv9l=UbK= zO-V4lnOLKZjN~VQA`$PjG&7-CQCSpY|0z)^%xe0BSQ-`NX+{EwandC&&A5(P_E;_Y zQ@OF5g6wzEh-}4vFU$bZyGMK>DD)d_)%FanfTtOz$uTc6gQ}Xm^+tlzu^-tc9KLH} z>b0LisY@I!?~;KoSrXAW)EIHq?jEfF1aE(uV8Zn^kn0;KEBvq}Ms^>=D#Wuj1@Ol+ zfbGHItRTf-8xorO(-1O~&*Ti}{dFDhQ*X_BrVr+1oB)9ES(s$sxu+Sxhlegr-GRq- zs0K6=$)(vZ9$fG#W_Z+;z zN~1DEmu?vxg?)MQNPV{l?Nn&*dtXMORe)^v`3j@K2YGi!y+Yy{Jugkj9K4FfXIxwc zAC;#G^M)j>hHfNJt$r0<4Oc&!tWvP-(&RL|*GAkQfb{}jqwTws);U~j+vIx?le*5I zF_GMj>^14}5o^CZw+N|v5bk})H&%&k+(2%U;<~!N5*0gORdMFt&JQVXlYG!tiWatW z?c@8#BO}~jmz)V zxGT2w9(@EY^C}ZeX(oEFx;*c7v8Ydmk%1^oKv@wNvP2{<`S|z= zB(+eiE+gYB1$x+`CKwxwzL(qnsGwQu7tTu>sE}PWjyO+T%7`?(50Q)c&4I2fag+iV zPl!FAu3qqU3--kCvHAMwh@Xl=(&R+1opF_DX45|{#t^)$JJMOS59=?flu&nUGqg!a zVR)zJV6fr9ze)a?S`oh7)H=QxqJ~MHms^Y$^sv9z1kTqXoF>@EAd4)z!vF9ZJIa0U zS^}#gu8N>BS9?#Bt#_qoQtn;t!aIUmrxt(cw7YG>;A+Z-VXUaO2Tmkam=>1qV2}J1 zTz--n7BF-(Z^0a;ZtJZA>oJ_i;N2L`R~M6Yy2`uLt`9?tfa_wk0-9KcJQjU)NE?3P-Gkd^oL*Q-VW`rU=8{lq60o)tl1z@6>SxamLfcHDaP(Ea)@bMY z&E-e)gYDC6_WN@rA3kMo@2r|wm>omi(@ z`E+Ovl@!{E(-AG_a=Tw7hede*&Q!aIW~mXxXrzV-XG%PiKgXBm2B)ay;JdCIYo_ef z+d2HocS?bZ8vJSj)V3)H+D>ZU)>87RCDBRp5NG!@+nJCZ)UZGmUYq(QZr^hnN)V^M z@{x6+)!#<>lV@UnGR3J;XxSUO_rjfwkB`H>28zd?F|7;e(&!3;#N=xa0tRff3Xw6t z_G=O=_{f@tfpe$2Wx$^#5s2Jh$pzQ$SJN4OV~U=*vK@h92PR1K1ZWIrD3+=#NTZs$ z+U}vMKF<6O&ClvG=eEmB4{XS4q+@)DW3#@T7G~;OL79a$aieYW4{c3>ReOORsVA0& z=?wmrhd83(I>qdI*-SN0w6O0~z!LyAC3$oqAesFFrWSOw#<)upY-~5|Mn1?BJa&2L|JK#fCxX43hN8bnFG|I_WFHN<0I$;(g`qVoZp(TUI7HSw565v z8~I?JR=J5)Y37$lvWfPdJ+C9}zWlW7iGC7SdLULI$u#%oq}LdP)2D<{i8RtgCf$|k z+E9pTssn9YrjSS;&+XtaC11&zo8czRzm{vKG4UtZyxp!mkh$UiS$WQ}^vum&>YC=Y z#{nAyQTM6GfQUGHo7Kr~v=V0`i|0|58|7h9CtU*u<0XS@F1eANHSn0j~G z&AsPM>c?n#k1_~J+DfT1kQs(kq?rV%-n*^hU{2_F##1Zq(e^6D2p2*st3cMEx!N1< zyasrD$reESVe&!@6hwPVTt#u~#y|DZB%wA`?9^ugGBjMF2t@afHYK_nI)s$M=@y+F zOgkKa+5&u^W|`QW!+CnGI$uMb*T!u$=?B;gC_r}2$Jl7I>;6yWyiv>&(UVb$U0aC9 zGTP@JV;Oy^Ck7Rm16kNHOH=K#H`0-Hm_tJ`X~0}83r{>+*Ut}&EiAOzlE1X6m}`?_>hp*>uj+s;0v=BQ)Zn6SRlbI)>{><~ z69bOnBHnMoURmU0_Lu6SKSg6SkFAtBN)q?xL7e@fyb1|6|7Q=>*swbRT?QJ=3 zjGi2SMz1J4%ZDyJVz1JK`Xg5VSzrS%+iJ34|KZj4f`h>Nnu3YWga!r&y zc%mTldI@#V0&9;9vhXt78{E~i6jTr}5KuS$mm>Y!Ydwpf%Ob}X6q7B+N}mtaHI+2x zZo+z_Yy^s4GWNSzvR#&gOaw$LxlWb9>DRYYG@Ec_6kx=Gfp~%K;;&C2oHl;>I9Di> z9*%f&WggHNHFw_iDn!OArR{VrOS~=KZ?ILKHy1F#Gr&|jk)C1#beLjp0-1H;1#T`Kw9hnJd5tov$01%NNl%?&^013aNVJ+b?$WbDZ8-00DAYS761SM literal 0 HcmV?d00001 diff --git a/README.md b/README.md index 9e977e6..8aeee98 100644 --- a/README.md +++ b/README.md @@ -10,26 +10,30 @@ Content Management System Vulnerability Hunter ### CMS 漏洞列表 +#### DedeCMS + +- [DedeCMS_v5.7_shops_delivery_存储型XSS](DedeCMS/DedeCMS_v5.7_shops_delivery_存储型XSS) + #### Struts - [S2-048(CVE-CVE-2017-9791)](Struts/S2-048(CVE-CVE-2017-9791)) -##### WordPress +#### WordPress - [WordPress_4.4_SSRF](WordPress/WordPress_4.4_SSRF) - [WordPress_4.7_Info_Disclosure](WordPress/WordPress_4.7_Info_Disclosure) - [WordPress_4.7.0-4.7.1_未授权内容注入](WordPress/WordPress_4.7.0-4.7.1_未授权内容注入) -##### PHPCMS +#### PHPCMS - [PHPCMS_v9.6.0_SQL注入](PHPCMS/PHPCMS_v9.6.0_SQL注入) - [PHPCMS_v9.6.0_任意文件上传](PHPCMS/PHPCMS_v9.6.0_任意文件上传) - [PHPCMS_v9.6.1_任意文件下载](PHPCMS/PHPCMS_v9.6.1_任意文件下载) - [PHPCMS_v9.6.2_任意文件下载](PHPCMS/PHPCMS_v9.6.2_任意文件下载) -##### Joomla! +#### Joomla! - [Joomla_3.7.0_SQL注入(CVE-2017-8917)](Joomla/Joomla_3.7.0_SQL注入(CVE-2017-8917)) - [Joomla_3.4.4-3.6.3_未授权创建特权用户(CVE-2016-8869)](Joomla/Joomla_3.4.4-3.6.3_未授权创建特权用户(CVE-2016-8869)) -##### FineCMS +#### FineCMS - [FineCMS最新版5.0.8两处getshell](https://github.com/SecWiki/CMS-Hunter/tree/master/FineCMS/FineCMS%E6%9C%80%E6%96%B0%E7%89%885.0.8%E4%B8%A4%E5%A4%84getshell) ### 项目维护