CVE-2018-20422

Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty wechatcommonmemberwechatmp to gain login access to an account via a plugin.php ac=wxregister request the attacker does not have control over which account will be accessed...

PT-2018-15366

Name of the Vulnerable Software and Affected Versions DiscuzX version 3.4 Description The issue allows remote attackers to bypass authentication when WeChat login is enabled. This is achieved by leveraging a non-empty wechatcommon member wechatmp to gain login access to an account via a...

PT-2018-15367

Name of the Vulnerable Software and Affected Versions DiscuzX version 3.4 Description The issue allows remote attackers to bypass a "disabled registration" setting when WeChat login is enabled. This can be achieved by adding a non-existing wxopenid value to the "plugin.php?ac=wxregister" query...