Discuz 7.2 存储型XSS

简要描述： Discuz 7.2 存储型XSS，可编写蠕虫传播。 详细说明： discuz 7.2 个人空间发表博客，默认管理员可编辑源码，但管理员可在后台设置权限允许普通用户编辑。 该处存在XSS弱点，可编写蠕虫进行传播。每个用户的表单hash值可在html获得，不需要考虑salt，获得cookie即可。 漏洞证明： discuz 7.2 进行表单提交时每个用户的表单hash值不一样，但是固定的，该值可在访问用户的html中获得。如图： 然后将hash代入组包，编写蠕虫即可。 var...

Discuz! 7.2 the following versions and various uc products api interface to Get webshell vulnerability-vulnerability warning-the black bar safety net

For dz, we are more concerned about is to get the shell, but the dz stuff want to take the shell too hard too difficult, on an article at the end of the bedding the next, so this article is also not on the horse after cannon....this vulnerability has been in the discuz! x1 version quietly give up...

Discuz! 7.1 & 7.2 back office remote code execution vulnerabilities and fixes-vulnerability warning-the black bar safety net

Beginning with the reception code is executed together with the see, this clear the code execution, see the estimates also a lot of good adhere to for so long has no one posted this half a year also used a lot of times, but...but eventually someone couldn't resist to publish, you know, published ...

Discuz! 体验站点跨站漏洞

简要描述： 去年就存在 一直未修复。。。杯具。。。 详细说明： 漏洞证明： http://www.discuz.org/ucserver/admin.php?m=user&a=login&iframe=%22%3E%3Cscript%3Ealert%28/insafe/%29%3C/script%3E...

Discuz! 体验站点跨站漏洞(2)

简要描述： sorry 两次提交 这个是刚刚登录后发现的。。 详细说明： 漏洞证明： http://www.discuz.org/forum.php?mod=viewthread&tid=1055&extra=%22%3E%3Cscript%3Ealert%28/%D6%ED%B8%E7%F6%A6/%29%3C/script%3E...

Discuz!漫游插件API本地包含漏洞

简要描述： Discuz!漫游插件API本地包含漏洞,该插件默认不安装,并且服务默认不开启. 详细说明： manyou/api/class/MyBase.php 128: function parseRequest 131: $request = $POST; 132: $module = $request'module'; 133: $method = $request'method'; ... 174: return $this-callback$module, $method, $params; 175: 177: function callback$module, $method...

Discuz! X1某页面存在XSS漏洞

简要描述： 页面对取到的参数没有过滤，直接echo到了html里。 详细说明： api/db/dbbak.php页面，对$apptype缺少必要的过滤，调用apimsg函数时直接将$apptype echo到了html中。 漏洞证明： http://www.discuz.net/api/db/dbbak.php?apptype=1%22%3E%3Cscript%3Ealert1%3C/script%3E%3C%22...

Discuz！7.2/X1 第三方插件SQL注入及持久型XSS漏洞

简要描述： Discuz！7.2/X1 第三方插件SQL注入及持久型XSS漏洞。 SQL注入比较鸡肋，要求GPC为off（目前这样的网站几乎绝版了） XSS因为是持久型的，只要管理员打开此应用即会触发。利用XSS怎么操作就见仁见智了。 详细说明： 由Discuz！认证的（http://addons.discuz.com/workroom.php）第三方开发团队“潮流少年工作室 Teen Studio”出品的心情墙插件（http://www.discuz.net/forum.php?mod=viewthread&tid=1632898），因变量未初始化及过滤不严导致SQL注入及跨站脚本漏洞...

Discuz! 7.x/6.x论坛绕过全局变量防御漏洞

Discuz!是一款华人地区非常流行的Web论坛程序。 由于php5.3.x版本php.ini的设置中requestorder默认值为GP，导致Discuz! 6.x/7.x中可以绕过全局变量防御。 在include/global.func.php代码中： function daddslashes$string, $force = 0 !defined'MAGICQUOTESGPC' && define'MAGICQUOTESGPC', getmagicquotesgpc; if!MAGICQUOTESGPC || $force ifisarray$string foreach$stri...

Discuz! 6. x/7. x a global variable Defense bypass vulnerability-vulnerability warning-the black bar safety net

Due to php5. 3. x version php. ini settings requestorder the default value for the GP, resulting in Discuz! 6. x/7. x a global variable Defense bypass vulnerability include/global. func. php code: function daddslashes$string, $force = 0 ! defined'MAGICQUOTESGPC' && define'MAGICQUOTESGPC',...

Discuz! 6.x/7.x 全局变量防御绕过漏洞

No description provided by source...

Discuz!NT 3.1.0 多处持久性跨站漏洞

Discuz!NT，是康盛创想北京科技有限公司旗下的一款功能强大的基于 ASP.net 平台的社区软件，包括论坛、Space 个人空 间、相册、聚合等功能，后台自由选择开启。 1.论坛相册空间日志发表评论，插入跨站语句即可： demo:http://nt.discuz.net/showphoto.aspx?photoid=42 2. 在论坛板块版面出随意选择一种浏览方式，然后修改或添加加入跨站语句，获得地址：...

PowerEasy 2006 Cross Site Scripting

PowerEasy is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the...

discuz X demo experience package XSS cross-site vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability file: source\function\directory most of the files filter is not strict Vulnerability testing:scriptalert/qing DISCUZ x test vulnerability/ Non-secure test the demo: http://fabu.coffly.com/home.php?mod=space&uid=1&do=profile...

Discuz! NT 3.0.0 background get WEBSHELL-vulnerability warning-the black bar safety net

http://test.com/admin/global/globaltemplatesedit.aspx?path=../&filename=index. aspx&templateid=1&templatename=Default Directly put your horse written in the forum index. aspx Or is the other file. path=../&filename=index. aspx But remember to get the SHELL to put the family file to restore it. Th...

Discuz! Cross Site Scripting

hi; All versions of Discuz! have the cross-site vulnerabilities because of the export value of "$referer". Like: Discuz! 7.X Discuz! 6.X Discuz! 5.X Discuz!NT 3.X and so on. There are some htm pages in all versions of Discuz!, that are: /templates/default/attachpay.htm /templates/default/ecrate.h...

Discuz! The latest to get Webshell method, test possible-vulnerability warning-the black bar safety net

Discuz! The latest to get Webshell method, the test feasible Inadvertently invaded the game's official website, can not get Webshell, the depressed found that there is a Discuz! Forum, immediately according to have to get the password of social workers, Oh, and actually successfully into the...

Discuz! 7.2 Cross Site Scripting

There is a Permanent-type Cross-Site Vulnerability in “Personal Signature” in all version of Discuz!. It can be written by the worm! Discuz! do not filter the Malicious code when user enter their personal signature, attacker can enter the xss code, Discuz! will save and run it! It maybe lead the...

Discuz! 7.2 插件/manyou/sources/notice.php sql注入漏洞

在最新的discuz! 7.2中自带了一个新的应用程序插件manyou。恰恰在这个新插件中，没有对传入的参数进行检查，在GPC为off的情况下，导致注入漏洞的产生。 /manyou/sources/notice.php if$option == 'del' $appid = intval$GET'appid'; $db-query"DELETE FROM $tablepremyinvite WHERE appid='$appid' AND touid='$discuzuid'"; showmessage'manyou:done',...

Discuz! 所有版本永久型跨站漏洞

Discuz! 个人中心里的“个人签名”没有对恶意代码进行检测，在 Discuz! 及 img 代码禁用的情况下仍可写入恶意代码，Discuz! 会保存并执行该代码，形成永久型跨站。 该漏洞可能导致蠕虫病毒的传播。 Disczu! = 7.2 Discuz!所有版本 官方暂无补丁，请网站管理员等待官方更新。 临时解决办法： 1、修改 memcp.php 代码，过滤个人签名字符。 2、禁止用户使用个人签名。 /textareascriptalert/Liscker/;/scripttextarea...